Report generated by XSS.CX at Fri Nov 19 20:55:10 CST 2010.
Hoyt LLC Research reports that tacoda.at.atwola.com is an Advertising and Content Delivery Network Host. The Servers provide targeted adverting which are often the targets of fraudsters. Do not click on an ad and instead go directly to the Host. Advertising is a form of inducement by which Phishing is conducted to exploit financial and personal information.
Date: March 14, 2011 @ 0149 GMT | Hoyt LLC Research observes that Search Engine landings for terms like tacoda.at.atwola.com and remove atwola are increasing at a rate that has a Vulnerability Crawler interrogating the tacoda.at.* Servers. Given the significant volume of Search Terms, greater than 100+ in the prior 12 hours, we expect to find Malware and/or Trojan Download.
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of the si request parameter is copied into the Set-Cookie response header. The payload 2317e%0d%0a6638b1327e8 was submitted in the si parameter. This caused a response containing an injected HTTP header.